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PREFACE. 
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the NASA safety process on previous spacecraft programs in the preparation of 
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refine our spacecraft safety packages. We believe that this package is 
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1.0 The Mars Observer Spacecraft 


The Mars Observer is a planetary exploration spacecraft that will be used 
to explore Mars. The spacecraft is being built for the California 
Institute Of Technology Jet Propulsion Laboratory (JPL) by RCA 
Astro-Electronics Division. RCA, as the prime contractor, provides the 
spacecraft bus and its associated subsystems and conducts the system 
integration and test activities for the entire flight system. The 

scientific payload is provided by JPL to RCA for integration with the 
spacecraft bus. The scientific payload subcontracts are managed by JPL. 
This package is directed toward the RCA provided bus and spacecraft 
subsystems while the scientific payload is discussed in an appendix to 
this package to be supplied by JPL. 
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1 .1 Mission Overview 


The Mars Observer Program has as its primary objectives a study of the 
geochemistry, atmospheric dynamics, atmosphere/surface interactions, 
seasonal variations and magnetic field characteristics of Mars. 

The instrument complement is a gamma ray spectrometer, a radar altimeter, 
an imaging system, a pressure modulated infrared radiometer, a thermal 
emission spectrometer, a magnetometer, an ultra-stable oscillator (for 
radio science) and a visual and infrared mapping spectrometer. 

These instruments were selected for their synergistic complementarity as 
well as their individual capabilities with the aim of providing an 
overall, comprehensive global data set to allow the systematic 
interdisciplinary study of Mars required to achieve the overall program 
goals. 

The Mars Observer spacecraft was specifically designed with the objective 
of accommodating the science requirements of this set of instruments, 
consistent with the requirement to utilize existing hardware and designs 
as dictated by the overall Planetary Observer philosophy. The hybrid RCA 
Satcom/TIROS/DMSP design fulfills both of these requirements 
simultaneously. 

The strategy to be used for MO is to operate all instruments essentially 
continuously, thereby providing a global data set from which seasonal 
variations and a comprehensive understanding of planetary morphology can 
be derived. This includes study of both large scale features at several 
spectral bands and very fine scale features (down to 1 meter surface 
resolution by the Mars Observer Camera) in regions of interest. 

Another key issue is the question of the volatile content of the Martian 
surface and its seasonal variation. A sun-synchronous orbit was 
specifically chosen to eliminate diurnal variations of observations so 
that longer term effects can be unambiguously assessed. 

In addition, the MO spacecraft will carry a sensitive magnetometer to 
determine if Mars has an intrinsic planetary field and, if so, its 
magnitude. This is a key scientific topic not only for the understanding 
of Mars but also for comparative planetology. 
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1.2 Spacecraft Description 


The system design for the Mars Observer Spacecraft is based predominantly 
on the Structure, Propulsion, and Thermal subsystems, and the Solar Array 
assembly of the RCA Satcom Ku-Band spacecraft, and the Attitude and 
Articulation Control, Command and Data Handling, and Power Subsystem of 
the RCA Advanced TIROS-N and DMSP Block 5D-2 spacecraft. The TIROS and 
DMSP programs are long running Atlas-launched RCA spacecraft with proven 
on-orbit performance. The only Mars Observer assembly-level items without 
flight heritage on RCA spacecraft are the Bipropellant portion of the 
Propulsion Subsystem and the High-Gain Antenna (HGA) assembly, a component 
of the Telecommunications Subsystem. The majority of the components for 
these items are however flight qualified and have been flight proven in 
several spacecraft applications. 

A pre-assembly view of the Mars Observer Spacecraft is shown in Figure 
1-1. The spacecraft mass is 723.4 Kg, and propellant mass is 1345.9 Kg. 
The TOS adaptor mass is 40.1 Kg. The total spacecraft mass at liftoff 
(less the TOS upper stage) is 2155.0 Kg (this figure includes a margin of 
45.6 Kg, which will be used). The paragraphs below provide an overview of 
the various spacecraft subsystems. Safety critical spacecraft subsystems 
are described in more detail in section 2.0 of this package. 

1.2.1 Communications 


The Mars Observer Telecommunications Subsystem is all new to meet the 
unique requirements of the MO mission. The Telecommunications Subsystem 
of TIROS/DMSP and Satcom K are not applicable to the MO mission. 

The design incorporates two GFP NASA X-band transponders (NXTs) and two 
GFP command detector units (CDUs). It also includes two 40W (rf output) 
traveling wave tube amplifiers (TWTAs), a 1.5-meter diameter HGA with 
2-axis gimbals and associated redundant control electronics, a hybrid 
mixer, passive rf components (switches, filters, etc), an assembly of six 
low-gain antennas (LGAs), and a medium-gain antenna (MGA). 

Apart from the GFP, only the NXTs are generically new to the RCA candidate 
spacecraft buses. 

The Telecommunications Subsystem provides the DSN-compatible X-band 
communications to and from the Earth for radiometric tracking, telemetry, 
commanding, and radio science. Command access through any of the three 
antenna systems is continuously available. Transmission mode (low-, 
medium-, or high-gain) is selectable by ground command. 
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1.2.2 Command And Data Handling 


The Command And Data Handling (C&DH) Subsystem is a direct application of 
flight proven TIROS/DMSP equipment, modified to incorporate the GFP 
Payload Data Subsystem (PDS).In the command role to control and 
reconfigure the spacecraft, it receives demodulated incoming signals, 
performs on-board computation, executes both received and 
computer-generated commands, and provides precision clocks for use 
throughout the spacecraft. In the telemetry role, the C&DH Subsystem 
synchronizes, times, collects, digitizes, multiplexes, formats, routes, 
stores, and plays back science instrument data, command verification, CPU 
memory dump, and payload and spacecraft engineering data. 

1.2.3 Attitude And Articulation Control 


The Attitude and Articulation Control Subsystem (AACS) is derived from the 
DMSP Block 5D-2 design, in particular that of Flight S— 1 5 . 

The AACS, in conjunction with the control segment of the C&DH Subsystem 
and the Propulsion and Pyrotechnics Subsystem, provides all functions 
associated with attitude sensing and control, appendage articulation, 
powered flight guidance, and navigation throughout all phases of the 
mission. It is comprised of an Inertial Measurement Unit (IMU) which 
includes four gyros and a redundant accelerometer package, a Mars horizon 
sensor assembly (MHSA) , a 6-slit strapdown celestial mapping sensor (CSA), 
a 4* steradian sun sensor (4*SS), four reaction wheel assemblies 
(RWAs), and software. 

1.2.4 Electrical Power 


The power subsystem is derived from the TIROS/DMSP boost-discharge Direct 
Energy Transfer (DET) design. The basic DET design has been tailored to 
meet the environmental and load requirements associated with the Mars 
Observer mission. The power subsystem provides the required generation, 
storage, control and distribution of electrical power for the spacecraft 
during all mission phases. 

The Mars Observer Solar Array has two deployment configurations. For the 
cruise and orbit insertion phases of the mission, the solar array is 
partially deployed with the boom still stowed. During the mapping and 
quarantine phases the solar array is fully deployed. The mission phases 
are discussed in section 1.5. 

1.2.5 Thermal Control 


The thermal design of the Mars Observer Spacecraft is derived from the RCA 
TIROS/DMSP, and Satcom Ku-Band Spacecraft. This basic, flight proven, 
design has been tailored to the widely varying thermal environments 
associated with the Mars Observer mission. Thermal control is 
accomplished by passive means where possible, with minimum resort to 
quasi-active devices (such as heaters and louvers). 
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The thermal design of the Mars Observer Spacecraft has been carefully 
optimized with a special view to power consumption, utilization of 
external fluxes, and minimum mass. The required thermal control is 
accomplished by the judicious application of multilayer insulation 
blankets, heaters, thermal control electronics, insulating and conducting 
structural elements, radiators, surface finishes, tapes, and louvers as 
well as configuration design of the spacecraft constituent elements, 
thermal coupling of body-mounted science GFP with the equipment enclosure, 
and use of the permanently space-viewing side (-Y) for radiative detector 
cooling and heat shedding. 

1.2.6 Structure 


The Structure, Cabling, and Mechanisms for the Mars Observer Spacecraft 
bus are derived from the primary structure of Satcom Ku-Band. The 
rationale for this choice is to minimize mass, to ensure compatibility 
with the TOS upper stage, to reduce thermal heater load requirements by 
nesting propulsion tanks inside the structure in close proximity to 
electronic equipment, and to use an existing flight qualified structure. 
The only major changes form the Satcom Ku-Band are in the Solar Array 
geometry and deployment sequencing. 

1.2.7 Propulsion 

The Mars Observer Propulsion Subsystem provides all the attitude control, 
trajectory corrections, and orbit insertion and trim maneuvers necessary 
to reach Mars and to extensively map the martian surface. Accomplishment 
of these maneuvers is performed by two independent propulsion systems, one 
employing hydrazine, the other bipropellants. The attitude control, 
Mars-orbit trim system uses flight-proven, long-life, RCA Satcom hydrazine 
blowdown propulsion system design and hardware. A state-of-the-art 
pressure-fed, Earth-storable, bipropellant system provides the desired 
higher performance for major mission maneuvers. 

The propulsion systems proposed are typical of those built by RCA for its 
communications and environmental spacecraft. RCA has flown or has 
in-build more than 27 communications-spacecraft hydrazine propulsion 
systems identical to the blowdown system proposed. Two of these systems 
have each demonstrated more than 8-1/2 years of flawless operation prior 
to propellant depletion and satellite retirement from service. For the 
TIROS/DMSP weather spacecraft, RCA has built, or has in process, 25 
pressure-fed regulated multi-engine, high-thrust, hydrazine (> 450N)/ 
nitrogen propulsion systems. 

All the propulsion subsystem components are flight qualified and most have 
been flight-proven on RCA spacecraft with the exception of the 0.94-m 
(37-in.) diameter propellant tank, which will be qualified for Mars 
Observer. Qualification is an extension of RCA's existing tank design 
technology. RCA was the first to verify use of capillary propellant 
management devices for propellant control on synchronous spacecraft and 
has qualified a series of tanks of increasing diameter since RCA Satcom-Fl 
flight in 1975. 
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The spacecraft scientific payload description and hazard reports are 
provided by 3PL in an appendix to this safety package. 



1.4 TOS/STS Interface 


The Mars Observer spacecraft will use the high performance Transfer Orbit 
Stage (TOS) which will be GFE (provided by MSFC). The TOS program is 
managed by Orbital Sciences Corporation (OSC) with design, development, 
production, and operations being handled by the Martin Marietta 
Corporation. The Mars Observer/TOS/STS interface is described in the 
following sections. 

1.4.1 Electrical Interface 


Electrical interfaces between the Mars Observer spacecraft and the TOS, as 
shown in figure 1-2, fall into two categories: 

o Spacecraft-to TOS avionics interfaces. 

o Spacecraft-to-Spacecraft EASE using the TOS stage as 
a pass-through 

The spacecraft EASE is comprised of a Power Master Unit (PMU) and a 
Command Master Unit (CMU). Interfaces between the spacecraft EASE and the 
TOS EASE consist solely of an Orbiter power feed from the TOS EASE 
terminal board and is fused by the spacecraft EASE. 

All spacecraft to TOS electrical interfaces use circular separation 
connectors located at the spacecraft separation joint. A wiring harness 
on the spacecraft adaptor links these connections with the adaptor-to-TOS 
connectors. RCA will be supplying this wiring harness and both matching 
halves of the connectors. 

The spacecraft-to-TOS avionics interfaces consist of connections from the 
spacecraft to the TOS Majority Vote Sequencer (MVS). After SRM burnout, 
redundant signals from the TOS Majority Vote Sequencer called "system 
Pre-Arm" and "System Arm", will drive latching relays of the same names 
housed in the spacecraft which pre-arm and arm the spacecraft pyrotechnic, 
thruster fire, and thruster latch valve command buses. Shortly before the 
prescribed spacecraft/TOS separation time, a similar "Separation Ready" 
signal will be sent from the MVS to the spacecraft computer which will 
subsequently command previously armed pyro-actuated propellant isolation 
valves to open. The spacecraft computer will then command the 
spacecraft/TOS Marmon clamp to separate. Redundant design techniques 
employed in the MVS combined with the "three inhibit" design of spacecraft 
pyrotechnic and propulsion control circuits precludes the possibility of a 
two-failure hazard as is prescribed by NHB 1700. 7A. These functions will 
also tolerate a single-point failure in the MVS or the spacecraft without 
jeopardizing mission success. 
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Figure 1-2. Spacecraft/TOS/Orbiter Electrical Interfaces. 


The baseline is to not include a telecommunications package on the TOS 
flight vehicle and to use the X-band transmitter and digital tape 
recording facilities on the Mars Observer spacecraft to transmit and/or 
record TOS telemetry after deployment from the Orbiter. As shown in 
figure 1-2, a serial telemetry stream (at 1.5 kbps) of engineering data is 
sent from the spacecraft Cross-Strap Unit (XSU) to the TOS telemetry 
encoder where the stream is combined with TOS telemetry (which is at 14.5 
kbps) to produce a combined spacecraft and TOS stream at a 16-kbps rate. 
The combined stream will be sent back to the XSU where it will be routed 
to the X-band transmitter and the spacecraft digital tape recorder. The 
combined stream will also be sent from the TOS telemetry encoder to the 
Orbiter Payload Data Interleaver (PDI) for crew display and transmission 
to the ground. Aware of PDI requirements on the format of telemetry 
frames, RCA and OSC are developing strategies for creating a 
combined-stream format compatible with the PDI. The TOS 
encoder/spacecraft electrical interfaces, which will subsequently be 
defined in detail, will minimize coupling with other spacecraft/TOS 
circuits in the EMI/EMC environment. 























The spacecraft will also pass electrical interfaces through the TOS stage 
to the spacecraft EASE. Serial spacecraft commands (at 2 kbps) will be 
sent from the spacecraft EASE to the spacecraft upon crew initiation via 
the Orbiter Standard Switch Panel (SSP) or GPC Keyboard/MDM, or upon 
transmissions from the Ground Support Equipment (GSE) via the T-0 
umbilical. Serial spacecraft telemetry (at 2 kbps) will be sent across 
the TOS to the spacecraft EASE for the PDI or for transmission to the GSE 
over the T-0 umbilical. A discrete command from the SSP, through the 
spacecraft EASE and through the TOS ASE will be supplied to the spacecraft 
to allow safing of all hazardous spacecraft functions simultaneously. 
Orbiter power conditioned by the spacecraft EASE will be provided to the 
spacecraft through the TOS. Maximum anticipated power to be delivered to 
the spacecraft is 300W. Power feeds on the TOS ASE, on the TOS itself, 
and on the spacecraft are being sized according to the requirements of 
JSC-07700, Volume XIV. Signal feeds are being designed and shielded to 
accommodate the EMI/EMC requirements of the same document, and TOS and 
spacecraft grounding will be to a single point on the TOS ASE. 

1.4.2 Mechanical Interfaces 


Figure 1-3 shows the spacecraft/upper stage cargo element for the Mars 
Observer mission. The spacecraft is cantilevered from the upper stage 
through a conical adapter and is located coaxially with the Orbiter cargo 
bay centerline. The allowable envelope for the cargo element, to include 
dynamic and thermal distortion effects, is the Orbiter payload clear 
envelope. The spacecraft lies well within this envelope. 

The adapter provides the interface flange for the bolted attachment to the 
upper stage and, in addition, limits the conductive thermal coupling 
between the spacecraft and TOS. Figure 1-4 shows the preliminary design 
of the adapter which is currently baselined for the Mars Observer 
mission. The Mars Observer design uses the standard unmodified TOS 
structural interface. This 91.91-inch (2335-mm) diameter forward ring 
frame structure contains 120 threaded mounting holes on a 90.6-inch 
(2301-mm) base circle. Indexing (clocking) of the attachment holes is 
achieved by a 1° offset in the position of the hole on the +X M0 (+Zy) 
axis, as shown in the figure. This indexing controls the MO/TOS 
coordinate system relationship to that shown in Figure 1-5. 
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Figure 1-3 Mars Observer/TOS Cargo Element 


To ensure adapter/TOS interface compatibility, the attachment holes in the 
RCA adapter will be controlled by a drill fixture supplied by OSC, and an 
adapter/TOS fit check will be performed at OSC as part of the 
spacecraft/upper-stage integration effort. The flight attachment hardware 
will be supplied by OSC and installed by OSC personnel with support from 
RCA. Access to the attachment bolts is gained from the spacecraft side of 
the interface. 

Analysis of the loading across the structural interface will be performed 
during Mars Observer program development to verify the integrity of the 
mechanical joint. The effect of the loading transferred to the TOS 
forward ring frame from the conical spacecraft adapter (kick loads) will 
be analyzed by OSC and the adequacy of the structure verified. The ring 
frame is sized to support a cantilevered mass of up to 9,000 lb (19,841 
kg) with a CG located up to 100 inches (2540 mm) forward of the 
interface. As the Mars Observer spacecraft and adapter weigh 2155 kg and 
have a combined CG located 1255 mm forward of the interface, no problems 
are anticipated. 

The Electrical Airborne support Equipment (EASE) for the Mars Observer 
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spacecraft (namely the Power Master Unit and the Command Master Unit ) are 
mounted on the TOS aft cradle ASE at the two locations shown in Figure 
1-6. At these locations, the spacecraft ASE lies well within the Orbiter 
payload envelope. The spacecraft ASE is mounted on the "hatband" 
secondary structure which is the standard method of attaching flight 
hardware to the TOS aft cradle primary structure. This allows flexibility 
in the attachment of Mars Observer avionics with no impact on the design 
of the primary (cradle) structure. 


«.7I Of* T mi (.34)01*1 
120 HOLES E0U*U.* S**CED 
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Figure 1-4. Spacecraft/TOS Adaptor 
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X M0 * Z T 

Imo = h .. NOTE: These are structural axes 

Z M q = 99 - Xj not flight control axes 


Orientation and Labeling: 

The Standard Subscript for TOS is "T", Mars Observer Spacecraft is 
"MO", and the Orbiter is "0". 

Origin of the TOS coordinate system is 123.96 inches forward (in the 
-X 0 direction) of the spacecraft Forward Ring Frame interface. 

Origin of the spacecraft coordinate system is at the separation plane 
between the spacecraft and its TOS adapter. This separation plane is 
located at Xt = 99 inches. 
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Figure 1-5. Spacecraft/TOS/Orbiter Coordinate System. 
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Figure 1-6. Equipment Mounting on TOS Cradle 
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1 .5 Mission Scenario 


An overview of the Mars Observer mission is depicted in figure 1-7. The 
mission comprises five basic phases: launch, cruise, orbit insertion, 
mapping, and quarantine. Figures 1-8 and 1-9 illustrate these phases. 

Launch can occur on any day between August 10 and September 9 during the 
Mars opportunity of August-September, 1990. Following separation from the 
upper stage, the spacecraft will enter the cruise phase which extends for 
approximately 1 earth year. During cruise up to four trajectory 
correction maneuvers may be required. Tracking and communications 
functions are provided by the Deep Space Network (DSN) in this phase and 
throughout the mission. While in cruise, the spacecraft bus must maintain 
a benign environment for the payload, make provision for instrument 
calibrations as necessary, and ensure that non-gravitational accelerations 
are minimized to permit reliable emphemeris predictions. 

The specified interplanetary trajectory (Type II) will take the spacecraft 
slightly outside the orbit of Mars. To minimize injection energy 
requirements, in-plane insertion will be used. This will result in a 
capture orbit with nominally a 4 am ascending node with a north polar 
approach. The arrival date will be between August 12 and August 30, 
1991. The nominal mission plan calls for completion of the orbit 
insertion phase and the beginning of mapping orbit operations in 
mid-October 1991, before the second conjunction period. 

Following mapping orbit insertion the spacecraft will be configured for 
science mission operations. Again, in this phase, the minimization of 
unmodeled nongravitational accelerations is an important requirement. At 
the end of the mapping phase in October 1993 the altitude will be 
increased to a stable quarantine orbit. While, formally, this completes 
the mission, nothing in the bus design precludes operations being 
continued into the quarantine phase if additional useful scientific data 
can be obtained. For this reason a sun synchronous quarantine orbit will 
be used. 
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1.5.1 Launch And Ascent 


Prior to lift-off, the spacecraft CPU memories will be loaded with their 
flight load packages, dumped and file compared using hard-wired links 
through the GSE. Command and telemetry links will be provided through the 
T-0 umbilical. The spacecraft status at lift-off is as follows: 

o Batteries connected (bus on Orbiter power) 
o Command and Telemetry via STS 
o All safety related items -SAFE 

o Ascent configuration of redundant equipment selected 
o RF transmitting elements - OFF 
o CPU memories loaded 

o CPUs on-line executing Idle Mode software 
o CPU Stored Command Table - OFF 
o IMUs - ON 
o RWAs - ON 

o All deployables stowed 
o All propulsion items OFF and SAFE 
o ASE - ON for communications and power via STS 
o Tape Recorder - On 

The spacecraft and its ASE will be largely quiescent during launch and 
ascent to parking orbit with the CPUs controlling the RWAs running at low 
speed to avoid damage from the launch loads. 

The communications link through the ASE and STS system provides a 2000 bps 
communication capability for transmission of engineering data via 
real-time link or for recording and playback later for analysis at JSC and 
JPL. In the launch configuration, the spacecraft poses no hazard to the 
Orbiter through flight system deployment, or in the event of an abort, 
through return and landing operations including the use of secondary or 
contingency sites. Safety monitoring is provided of all critical 
functions in the aft-crew compartment. 

1.5.2 On-Orbit And Deployment 

After reaching the desired orbit altitude, the Orbiter' s payload bay doors 
will be opened between 1 and 3 hours after lift-off. A series of early 
spacecraft system checks can then be accomplished by the ASE through the 
Orbiter' s standard switch panel. After initial checkout, the spacecraft 
will be configured in a quiescent mode to await the start of the 
deployment sequence. The RWAs will be switched off and both batteries 
will be placed on trickle charge (C/60 rate) on Orbiter power via the 
ASE. 

Data from the spacecraft will be provided via the ASE for review in the 
aft-crew compartment. These data will be primarily safety-related to show 
the status of all Propellant and Pyrotechnic Subsystem elements. The 
sensing system associated with these safety-related items will be 
sufficiently redundant to assure unambiguous interpretation of the 
spacecraft safety status. 
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Figure 1-8. Mars Observer Mission Phases - Launch to Orbit Inserti 
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Figure 1-9. Mars Observer Mission Phases 


Orbit Insertion to Quarantine. 
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During parking orbit operation, the Orbiter payload bay will normally be 
oriented towards the earth. For initialization of the upper-stage 
guidance system, the Shuttle will be maneuvered to ground-specified 
orientations for short periods of time and then returned to its nominal 
attitude. The spacecraft itself does not require these maneuvers, 
however, the opportunity may be taken to test the IMU concurrently. The 
thermal design of the spacecraft will accommodate these maneuvers and can 
support the spacecraft in this quiescent state for several days in the 
event the primary deployment opportunity cannot be satisfied. 

Based on the achieved Orbiter state vector, the upper-stage injection burn 
orientation and timing will be computed on the ground and relayed to the 
Orbiter crew via JSC. At the appropriate time, the Orbiter will maneuver 
to the required upper-stage burn attitude and the reference gyros will be 
initialized. This reference attitude will be maintained in upper stage 
memory for use after deployment. If necessary, the reference attitude can 
be updated from the POCC and the changes verified by telemetry via the STS 
communications system. 

Prior to deployment from the Orbiter payload bay, an autonomous Go/No-Go 
checkout will be initiated by a single Standard Switch Panel Command. 
Using self-test routines (SELTS), various state-of -health functions will 
be performed by both CPUs. At the conclusion of the checkout, a Go/No-Go 
indication is provided to the Orbiter general-purpose computer display. 

Following successful completion of the Go/No-Go check, with verification 
of the on-board indication from the ground, the deployment sequence will 
be initiated by the flight crew. The upper stage will be armed by command 
from the aft-crew compartment; with the Orbiter in a stable position, the 
crew will activate the separation device. The Orbiter will not be 
constrained to the injection burn attitude for deployment since after 
initialization the orientation is retained by the upper stage. A 
separation velocity of at least 1 ft/sec will be imparted to the flight 
system relative to the Orbiter, and a separation signal provided by the 
Orbiter. An on-board spacecraft timer which starts at separation will 
activate the Propellant and Pyrotechnics Subsystem when safe 
Orbiter-spacecraft separation has been achieved. Deployment will occur 
between 45 minutes and 1 hour before upper-stage ignition. The flight 
system is compatible with earth or Orbiter shadowing during deployment 
operations. No EVA activities are required as part of the deployment 
sequence; all crew activities can be performed from the aft-crew 
compartment. No spacecraft control is required during this sequence; all 
Safe and Arm functions for the flight system are performed and verified 
on-board the Orbiter. 

If the deployment is aborted for any reason after the sequence has started 
but before separation, the upper-stage ASE will have the capability to 
restow the flight system in a safe condition for the rest of the Orbiter 
mission including return and landing. The spacecraft will provide a 
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positive indication that its deployment sequence has stopped and that all 
propulsive elements are in a safe state. In the extremely unlikely event 
that it is not possible to restow the spacecraft or to confirm that the 
flight system is in a safe state, the flight system will be ejected by the 
upper-stage ASE. 

The ASE will be designed so that following deployment of the flight system 
it will not impose any limitations on Orbiter attitude or extended mission 
operations. 

Spacecraft activiation will be performed by an on-board timer which starts 
at separation from the Orbiter and ensures that for the minimum separation 
velocity, a safe distance will have developed before any propulsion or 
pyrotechnic elements are activated. 

When the spacecraft is in the Orbiter payload bay, all telemetry and 
command links will be via the ASE and STS system to the ground. There is 
no requirment to deploy any antenna or other appendage on the spacecraft 
until after separation and activation. After deployment of the flight 
system from the Orbiter bay, all communication from the spacecraft will be 
directly to the ground. No spacecraft/STS links will be required. 
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2.0 Safety Critical Spacecraft Systems 


The following sections provide more detailed discussions of subsystems 
that have been identified at phase zero as safety critical during ground 
or flight operations. All components of the spacecraft and it's airborne 
support equipment are located in the cargo bay, there are no components in 
the crew compartment. 


21 



2.1 Communications 


The communications subsystem block diagram is shown in Figure 2-2 and the 
communications antenna locations on the spacecraft are shown in Figure 

2-1. Antenna coverage is provided by a steered high-gain antenna (HGA) , a 
fixed medium-gain antenna (MGA) or a set of wide coverage low-gain 

antennas (LGA), depending on the phase of the mission and operational 

conditions. The HGA is used to monitor telemetry during thruster firing, 
check spacecraft attitude prior to and after thruster firing, and for 

communications with the spacecraft during the mapping phase. During 
maneuvers the HGA will be uncaged to permit motion around one gimbal axis 
while the HGA boom remains partly stowed. The medium-gain antenna is used 
for communications with the spacecraft during the outer portion of the 
cruise phase and during the early Mars orbit phase, except during 
maneuvers in which case the HGA is used. The low-gain antennas are used 
from the time of Shuttle separation through the inner portion of the 
cruise phase, except for maneuvers. One LGA is used to transmit flight 
system telemetry during the time from shuttle deployment to TOS 
separation. The low-gain antennas are also available throughout the 
mission for emergency communications with the spacecraft, should this 
become necessary. 




HGA 


FULLY DEPLOYED 
HGA BOOM 



MAPPING 

CONFIGURATION 


Figure 2-1. Antenna Locations 
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KEY COMPONENT CHARACTERISTICS 

• TWO COMMAND DEMODULATOR UNITS (CDUs) 

- GFP 

- 16 kHz SUBCARRIER INPUT FROM NXT 

- COMMANDS AT 7.81 25 bps AND 31.25 be* 

• TWO NASA X-6AND TRANSPONDERS (NXT) 

- GFP 

- DEMODULATED COMMAND SUBCARRIER TO CDU 

- COHERENT TURNAROUND OR ONE-WAY TRANSMISSION 

- ULTRA-STABLE OSCILLATOR INPUT 

- PHASE MODULATED BY TELEMETRY • RANGING 

- TWO-WAY OR ONE-WAY RANGING 

• TWO POWER AMPLIFIERS 

- 40W RF OUTPUT B 110W INPUT (EACH) 

- TRAVELING WAVE TUBE AMPLIFIER ITWTAS) 

- EPC & TWT PACKAGED SEPARATELY 

- 6 dBm RF INPUT 

• SIX LOW GAIN ANTENNAS ILGAS) 

- Z dB* GAIN 

- 4 TRANSMIT. 2 RECEIVE 

- HEMISPHERIC BEAM 

- RIGHT-HAND CIRC. POL 


• ONE MEDIUM GAIN ANTENNA (MGAI 

- XMIT GAIN 28.5 dB*; REV GAIN 30.5 dB* 

- 6° BEAMWIDTH BETWEEN 1 - dB POINTS 

- LEFT-HAND CIRC. POL 

• ONE HIGH GAIN ANTENNA (HGA) 

- 1 m DIAMETER REFLECTOR 

- XMIT GAIN 36.3 dB>; REV GAIN 34.3 dB< 

- 1.5° BEAMWIDTH BETWEEN 1 - dB POINTS. 

- LEFT-HAND CIRC. POL 

• TWO GIMBALS 

- PERMANENT MAGNET STEPPER MOTORS 

- HARMONIC DRIVE GEARS 

- ROTARY WAVEGUIDE JOINTS 

- 0.0075° STEPPING GRANULARITY 

- OPTICAL SHAFT ENCODERS 

• ONE STEPPER DRIVE ELECTRONICS (SDE) 

- GENERATES STEPPER PULSES 

- DRIVES BOTH GIMBALS AND SAD 

- COMMANDED FROM COMPUTER 
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Figure 2 - 2 . Communications Subsystem Block Diagram. 
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The uplink signal can include carrier only, command modulation, ranging 
modulation, or command plus ranging. In any event, it is received by the 
receive section of the transponder, which demodulates the command and 
ranging signals (if present). Each demodulated command baseband is sent 
to a command detector unit, which supplies a detected command data stream 
to the Command And Data Handling (C&DH) Subsystem for decoding. 
Demodulated ranging signals are remodulated onto the transmit carrier in 
the exciter section of the transponder. During two-way communications, 
the transmit carrier frequency is coherently related to the uplink carrier 
frequency with an 880 to 749 ratio. If no uplink is present, the transmit 
carrier is derived from an internal auxiliary oscillator with the same 
nominal frequency as used in two-way operation. For radio science 
measurements, an ultra-stable oscillator (part of the GFP payload) can be 
switched in to replace the auxiliary oscillator. The downlink signal can 
be modulated by the turn around ranging signal or the telemetry data 
system from the C&DH subsystem or both. The transponder can be commanded 
also to provide a one-way ranging modulation signal instead of two-way 
ranging. At any given time, only one of the two transponders has its 
exciter section energized. 

The output from the energized exciter goes through a 3-db hybrid coupler 
which feeds the signal to both rf power amplifiers, only one of which is 
energized. The rf power amplifier provides a 40-watt output to an 
isolator and rf filter. 

A network of rf transfer switches connects the transmit signal to the 
selected antenna. The network is configured to provide either rf power 
amplifier access to each of the antennas. For communications while in the 
Shuttle orbit, the rf power amplifier is by-passed and the transponder 
output is switched directly to one of the low-gain antennas. Rf 
circulators are used to permit simultaneous receive and transmit access to 
the high-and medium-gain antennas. 

The subsystem is controlled by commands from the C&DH Subsystem. Discrete 
commands control the transponder operating modes, the command detector bit 
rate, the transmit switch configuration, and the on/off status of the rf 
power amplifiers. Serial commands from the C&DH Subsystem control the 
high-gain antenna pointing. Telemetry points monitor the operating status 
and temperatures of the subsystem components. Serial telemetry data 
provide signal-to-noise ratio (SNR) estimates from the CDU, and antenna 
pointing information from the HGA. 
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2.2 Command And Data Handling 


The Command And Data Handling (C&DH) Subsystem block diagram is shown in 
Figure 2-3. 

All control functions are accomplished by dual (redundant) on-board 
central processing units (CPUs) each with 64K words of random access 
memory (RAM) and 256 words of read-only memory (ROM) for bootstrapping, a 
controls interface unit (CIU), a controls interface unit annex (CXU), a 
signal conditioning unit (SCU), and four pyrotechnics relay assemblies. 
The CPUs provide both data-processing flexibility and computational 
capability. Each CPU has sufficient RAM for autonomous operation for up 
to 60 days for the Mars Observer mission. The CPU, via the CIU, provides 
all control and computation functions for all modes of attitude 
determination and control, powered flight guidance and navigation, command 
decoding, checking, storage and distribution, power management, failure 
diagnosis (including self-diagnosis), and redundancy switching. Identical 
software packages reside in each CPU with provision for autonomous 
switching between CPUs (via a watchdog timer) in the event of a self-check 
failure indication. Single-bit error correction and two-bit error 
detection are special features of the design. 

The CPU Flight software comprises a set of interrelated modules grouped 
into five main categories: Command and Control, Guidance and Navigation, 
Self-Test, Redundancy Management, and Executive. The software may be 
modified or changed out via uplinks. Low level commands are distributed 
by the CIU and CXU; those requiring high-current drive capability are 
conditioned in the SCU, and the Pyrotechnics Relay Assemblies (PRAs). 

The CIU links all command-and-control -elements of the C&DH Subsystem, and 
interconnects the computers with all other spacecraft components. It 
provides direct hardware access (bypassing the CPU) for certain critical 
commands. Included in the CXU is 8k words of programmable read-only 
memory (PROM) for the safe-system mode firmware, which is CPU 
independent. A redundant crystal-controlled oscillator (RXO) provides a 
5.12-MHz source for all spacecraft timing functions. A controls power 
converter (CPC) provides the necessary tightly regulated power (+10 Vdc) 
for the command and control units. 

To accommodate the data handling requirements, three additional redundant 
blocks are included: the engineering data formatter (EDF) together with 
the GFP payload data subsystem (PDS); the cross-strap unit (XSU); and two 
1.5 x 109 bits capacity Odetics digital tape recorders (DTR) . This 
system synchronizes, times, collects, digitizes, multiplexes, formats, 
routes, stores, and plays back science instrument data, command 
verification, CPU memory dump, and payload and spacecraft engineering 
data. The PDS also applies Reed-Solomon error coding to the data streams. 

Four data streams (Science and Engineering 1 and 2, spacecraft bus 
engineering, and spacecraft bus and upper-stage engineering) are input to 
the XSU. By ground command, any one of the four streams can be selected 
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KEY COMPONENT CHARACTERISTICS 

• TWO CENTRAL PROCESSING UNITS (CPUS). EACH: 
-64k WORDS RAM 

- 256 WORDS ROM (BOOTSTRAPPING) 

- SINGLE ERROR CORRECTION. 

DOUBLE ERROR DETECTION 

- 52 INSTRUCTIONS 

- 2.34 MICROSECOND CYCLE TIME 

- SINGLE AND DOUBLE PRECISION 

• CONTROLS INTERFACE UNIT (CIU) 

- COMMAND DECODING 

- CPU INTERFACE 

- 224 DISCRETE COMMANDS 

- 19 SERIAL BUFFERS 

- CLOCK GENERATION 

- ATTITUDE CONTROL ELECTRONICS 

• CONTROLS INTERFACE UNIT ANNEX(CXU) 

- 8k WORDS PROM FOR FIRMWARE FOR 

ATTITUDE INITIALIZATION, SAFE-SYSTEM, 
CRUISE ORIENTATIONS 

- 192 ADDITIONAL LOW-LEVEL COMMANDS 

• SIGNALS CONDITIONING UNIT (SCU) 

- HIGH LEVEL COMMAND INTERFACES 

- PRE-ARM AND ARM RELAYS FOR PYROTECHNICS 

- THRUSTER FIRE SIGNALS 


• PYROTECHNIC RELAY ASSEMBLY (PRA) 

- FIRE RELAYS FOR PYROTECHNICS 

- COMPLETELY SHIELDED 

- 4 VOLTS 

• REDUNDANT CRYSTAL OSCILLATOR (RXO) 

- 5.12 MH Z TIMING SOURCE 

- STABILITY 1 PART IN 10 6 OVER 3 YEARS 

• PDS 

- GFP 

• ENGINEERING DATA FORMATTER (EDF) 

- ENGINEERING PACKETS TO PDS 

- ENG DATA STREAM AT 1500. 200. 10 bps 

- TRANSFER FRAME FOR ENG DATA 

• CROSS STRAP UNIT (XSU) 

- OUTPUT STREAM SWITCHING 

- CONVOLUTIONAL ENCODING 

- SUBCARRIER OSCILLATOR AND MODULATOR 

- AMPLITUDE CONTROL 

- DATA INTERFACE WITH UPPER STAGE 

• TWO DIGITAL TAPE RECORDERS (DTRS), EACH: 

- 1.5 X10 9 BITS STORAGE 

- BER 1 IN 10 6 , 
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Figure 2-3. C&DH Subsystem Block Diagram. 
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for transmission. In addition, ail but the S&E-2 stream can be 
simultaneously recorded on either of the two DTRs. Recorded data can be 
selected for transmission instead of real-time telemetry. The XSU is a 
flexible routing control unit providing, complete interchangeability of 
input data streams, output channel, and DTR usage, by ground command. The 
EOF is a general-purpose microprocessor-controlled telemetry processor, 
whose output format can be modified by command. It collects engineering 
data and generates packets for the PDS and for direct transmission. It is 
a derivative of the DMSP/ATN Programmable Information Processor introduced 
on OMSP in 1981 and flown on DMSP Block 50-2 flights F6 and F7. 

Launch by the SSV and injection by the TOS necessitate new launch-vehicle 
telemetry interfaces. To save launch mass, the telemetry handling system 
of the OSC TOS has been removed. Before deployment of the flight system 
from the Orbiter, TOS telemetry and spacecraft telemetry are routed 
separately, via the electrical airborne support equipment (EASE) into the 
Payload Data Interleaver (POI) of the SSV. Following deployment, 
spacecraft telemetry is routed from the EOF to the telemetry encoder in 
the OSC TOS, the majority vote sequencer (MVS), and is interleaved with 
TOS telemetry. The mixed telemetry stream is then passed back to the XSU 
for transmission to the ground by the X-band Telecommunications Subsystem, 
using an NXT directly coupled to an LGA. 
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2.3 Electrical Power 


The Power Subsystem provides the required generation, storage, control and 
distribution of electrical power for the flight system during all phases 
of the Mars Observer mission. This subsystem includes a photovoltaic 
solar cell array, two nickel-cadmium secondary batteries (with KOH 
electrolyte pressurized at 45 psi), power conditioning electronics, 
distribution, and an automated battery energy management capability. 
Elements of the subsystem are connected in a direct energy transfer (DET) 
configuration, using solar array sequential partial shunt regulation and a 
battery voltage boost-regulator scheme. 

Figure 2-4 presents the Mars Observer (MO) Power Subsystem functional 
block diagram. The Power Subsystem consists of the following components: 

o Solar Array (SA) 

o Solar Array Drive (SAD) 

o Array Drive Electronics (Part of SDE) 

o Power Supply Electronics (PSE) 

o Battery Charge Assembly (BCA) 
o Batteries (B) 

o Battery Reconditioning Unit (BRU) 
o Power Converter (PC) 
o Fuse Board Unit (FBU) 

The Power Subsystem Electronics (PSE, BCA, PC) accepts power inputs from 
the solar array and the batteries (via BVR) and provides a regulated 

output at 28 Vdc ± 2 %. The PSE and BCA control the charge current to the 

batteries to within selected limits, and when full array output power is 
not required reduces solar array current output via a redundant shunt 
system. During periods when array power is unavailable or is 

insufficient, the batteries will discharge through the BVR to maintain the 
bus at the regulated voltage. 

The BCA passes current from the solar array bus to each battery. The 
charge current is limited by the mode control (a part of the PSE) based on 
the charge rate selected by ground command and by the sensed V/T feedback 
signal from the battery. 

A PWM boost regulator supplies energy from a bus supplied by all the 

batteries to the 28-volt regulated bus during eclipse periods or when the 
solar array ouput is not adequate to supply load current demands. The 
battery bus voltage is boosted as required to maintain the regulated bus 
at 28 volts. A "short" failure in one cell of the 17 cells can be 
accommodated by the BVR. 

A partial shunt regulator reduces the current output from the solar array 
when full output is not required for satisfying load requirements and for 
charging the batteries. The partial-shunt configuration consists of 18 
switched sections and two parallel linear sections. Each section is 
connected across a single solar cell circuit of 31 series and 15 parallel 
cells. The shunt operation is accomplished by electrically mismatching 


28 




29 


5-2840 





























selected portions of the solar cell circuits controlled by the partial 
linear shunt section. The remaining cell circuits are controlled by 
switched partial-shunt regulators which operate in either the "OFF" or 
"ON" (saturated) modes. The binary shunt regulators are activated as the 
linear shunt section approaches its fully loaded condition. The Mode 
Control is the control element for power regulation and causes the 
appropriate mode to be selected. It senses voltage change on the 28V bus 
and applies drive signals to the appropriate regulatory elements to 
maintain the 28 volts within the ± 2 % tolerance. 

Failure-detection circuits continuously monitor the operation of the 
charge controllers, shunt control amplifiers, boost regulator, and mode 
control. If a failure is detected, automatic switchover from the primary 
to backup side is implemented. Either the primary or backup function may 
also be selected by ground command. All automatic switching functions can 
be overridden by ground command. 

Battery state-of-charge is automatically controlled using a C/0 - 
augmented V/T limit technique which utilizes Standard Controls Processor 
(SCP) software and Power Subsystem hardware. Battery overcharge is 
rigorously controlled to minimize battery degradation. Battery cell 
reconditioning will be performed just prior to Mars orbit charge/discharge 
cycles to ensure proper cell voltage balance and maximum battery 
performance. 

The spacecraft receives power from the Orbiter via the Power Master Unit 
(PMU), which is a piece of EASE mounted on the TOS cradle. The power 
required when connected to the Orbiter is TBS at phase one. 
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2.4 Thermal Control 


The Mars Observer thermal design makes maximum use of passive thermal 
control where possible and only resorts to the use of active thermal 
control elements when necessary. Passive thermal control elements include 
multilayer insulation blankets, radiators, structural insulators and 
conductors, tapes, and surface finishes. Active thermal control elements 
include combinations of Satcom-type Thermal Control Electronics (TCE) 
units, louvers, and heaters. 

During pre-launch, conditioned air within the cargo bay will maintain 
benign average temperature levels (this temperature is TBD) which the Mars 
Observer Spacecraft will be compatible with. After launch, the Orbiters 
cargo bay doors will open no sooner than 1 hour and no later than 3 hours 
after liftoff. In the latter case, spacecraft component temperatures may 
reach 30°C prior to opening of the cargo bay doors. Temperature rise due 
to internal dissipation in this relatively warm environment is attenuated 
by the thermal capacitance of the spacecraft. Once the cargo bay doors 
are open, the spacecraft is subjected to the Orbiter +ZLV orientation as 
well as multiple allowable excursions to +Z Solar for 30 minutes and to +1 
Deep Space for 90 minutes. Spacecraft recovery time from these excursions 
is TBD. Thermal analyses of the Mars Observer/Space Shuttle Vehicle (SSV) 
in these scenarios have shown that heater power is required to maintain 
the spacecraft at the minimum allowable temperatures within the SSV 
environment. 

In the event of an abort situation and touchdown at a primary or secondary 
landing site, a conditioned air purge is made available within 15 minutes, 
providing a means for removal of heat absorbed during SSV reentry. At a 
contingency landing site (where no cooling is available), the hottest 
transient temperature reached by any localized part of the cargo bay is 
96° C (per STS83-0425). The spacecraft is able to withstand the payload 
bay environment, maintaining component temperatures and tank pressures 
within safe limits. 

A major issue is the pressure buildup in the fuel tanks due to increasing 
temperatures. However, the 5% tank ullage is sized to permit adequate 
margin for a steady-state temperature of 70° C, which is well above the 
overall average payload bay liner temperature during a post-contingency 
landing. 
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2.5 Structure. Cabling, and Mechanisms 


The structures principal function is to serve as the spacecraft's physical 
interface with the launch vehicle and to support the other spacecraft 
subsystems. The structure also externally supports and aligns the payload 
sensors, solar array, antennas, and thrusters. The external configuration 
of the spacecraft in it's mission mode is presented in Figure 2-5. The 
Mars Observer launch configuration is shown in figure 2-6. 


The general arrangement of the Mars Observer structure is shown in Figure 
1-1. As in all the Mars Observer predecessor communications spacecraft 
the center structure assembly, extending from the top panel (nadir-facing 
panel) to the separation plane, is the primary load path of the 
spacecraft. This cylindrical assembly is joined to the side panels by 
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means of bulkheads. At the base panel, the center structure changes to a 
conical section and terminates in a separation ring that is the interface 
with the TOS adaptor. The center structure assembly directly supports two 
large propellant tanks within the cylinder. It is also the support for 
other Propulsion Subsystem components that are brazed into half-systems in 
a separate fixture and then joined to each other and to the center 
structure assembly. Struts extend from the cylinder and bulkheads to 
internal bipropellant and monopropellant tanks to react lateral loads. 
Thrust loads from these tanks are reacted by shear fittings in the 
bulkheads (four bipropellant tanks) and in the cylinder (monopropellant 
tanks). The equipment mounting panels are divided into halves separated 
by chambers, one of which is occupied by the solar array boom during 
launch. The four equipment mounting panels support the bulk of the 
electronic equipment. The velocity and anti-velocity panels are designed 
as structural shear panels that can be readily removed thus allowing 
access during all phases of integration and test. The top panel 
(nadir-facing) and the base panel complete the box structure and transfer 
lateral louds to the center structure. 

The Mars Observer structure supports a 102-kg payload which compares 
favorably with the 170-kg payload of the Satcom Ku-Band Spacecraft for 
which the structure was originally designed. The Mars Observer payload is 
located principally on the nadir surface of the spacecraft. Support 
brackets that extend from sensor attachments to structural "hard points" 
are provided where required for each sensor. The nadir-facing panel is 
shared by attitude reference sensors and pressurant tanks. 

The forward end of the adapter mates with the separation ring and clamp 
band developed for Satcom Ku-Band, and the aft end terminates in a flange 
containing a bolt circle on a diameter of 90.6 inches. This bolt circle 
is the actual structural interface with the upper stage. It is controlled 
by drill fixtures built by the upper stage contractor. The fixtures are 
"mastered" to ensure matching of holes, and fit check will be performed at 
the upper stage contractor's facility. 

Two separation connectors provide the electrical interface between the 
spacecraft and adapter. The adapter cable is actually part of the upper 
stage cable assembly with no additional connector between adapter and 
stage. Both halves of the separation plane connectors will be procured by 
RCA who will supply the stage halves to the stage contractor. 

No direct mechanical interface exists between the Mars Observer and the 
STS, because the spacecraft is totally supported by the upper stage. 
However, the volume, natural frequency, and center of gravity of the 
spacecraft must satisfy STS constraints. 

The spacecraft on the upper stage is oriented horizontally and coaxially 
in the STS. The circle that circumscribes the spacecraft has a diameter 
of 136 inches, well within the 180-inch allowable envelope. 

Cantilevered from the upper stage, the spacecraft, on its conical adapter, 
has a fundamental frequency of 16.7 Hz. This value is typical of the 
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by the STS control system. The fundamental frequency of the entire cargo 
element (spacecraft, upper stage, and ASE) is greater than 7 Hz. The weight 
of the cargo element is well below the 29,478 kg (65,000 lb) limit of the 
STS. Its location must be chosen to meet the c.g. limits of the STS when 
the mass properties of co-manifested payloads are identified. 



The solar array is located on one side of the spacecraft to accomodate the 
fields of view of the radiative coolers of both the PMIRR and VIMS. The 
solar panels and their associated boom are stowed during launch against 
the side of the spacecraft. They are retained by cables through the 
panels and at their edges. Figure 2-8 shows the stowed solar array and 
boom and figure 2-7 shows the solar array restraint. Release of the solar 
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Figure 2-8. Stowed Solar Array and Boom 
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array is effected by the firing of redundant cable cutters. The solar 
array deployment sequence is illustrated in figure 2-9. Deployment of the 
array to the cruise configuration is initiated by firing the cable cutters 
that sever the six primary restraint cables. The three unrestrained 
panels then deploy one after the other by means of a passive sequencing 
system, into a planar array at the side of the spacecraft. Deployment is 
energized by springs and damped by viscous dampers at each hinge axis. 
The elements of the deployment system are identical to those flight proven 
on Satcom Ku-Band. 

2.5.2 Instrument Booms 


The Gamma Ray Spectrometer (GRS) and Magnetometer (MAG) are mounted on 
identical booms that must have the ability to be extended and retracted 
for calibration during cruise, retracted for MOI burn, and finally 
extended for the mapping mission. 

Coilable longeron booms have been chosen for these functions because of 
their extension/retraction capability, deployment repeatability, light 
weight, stiffness, and compact stowage. The 22.9 cm (9-inch) diameter 
(circumscribing circle) boom used on the Voyager, NOVA, and Dynamics 
Explorer (DE) spacecraft has been selected as the baseline for the Mars 
Observer mission. The boom retraction technique was used on the S 3 and 
Solar Maximum missions. The booms are self energizing and are released 
from their canisters by severing their restraint cables with redundant 
pyrotechnic cable cutters. Deployment energy is attenuated by using the 
retraction motor to limit the rate of extension of the lanyard attached to 
the tip of the boom. Retraction is accomplished by a brushless DC gear 
motor which winds the lanyard onto a spool. To retract the fully extended 
boom requires a torsional moment to be applied to the end to initiate the 
coiling of the longerons. This action is effected by a bridle attached to 
the end plate which is pulled by the lanyard. 

The magnetometer boom is required to support two such instruments, one at 
the tip and the other near the mid-point. The latter instrument will be 
located outside the cross-section of the boom. This technique, previously 
demonstrated on Voyager, allows the boom to be coiled and compressed into 
its canister as a single continuous element, because the mid-point 
instrument is not in the way, as it would be with a centered instrument. 
The externally mounted magnetometer is supported by a bracket from the 
boom. As the boom is compressed into its canister for stowage, the 
bracket passes through a slot in the canister, and the instrument itself 
is seated externally. 

Boom length is six meters, and its lowest natural frequency when 
supporting the GRS at its tip is 0.32-Hz. This is well above the minimum 
required by the attitude control system. The strength of the booms is 
ample to sustain the thrust levels (0.015 g) experienced during firing of 
the four 22. 2N (5-lbf) velocity correction thrusters and by the four 
22. 2N bipropellant thrusters used for insertion into quarantine orbit. 
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Figure 2-9. Deployment Sequence. 


Figure 2-10 illustrates two different coilable longeron booms that RCA has 
used to deploy instruments from previous spacecraft: the NOVA U.S. Navy 
navigation satellite and the Dynamics Explorer (DE) scientific satellite. 
The latter boom is the baseline for supporting the GRS and the MAG in the 
Mars Observer mission. 

2.5.3 High Gain Antenna Deployment Mechanisms 

The HGA boom design, its supports and geometry must be such as to afford 
the antenna a clear field of view (FOV) of Earth during the cruise phase 
and later during the mapping orbit phase. A key requirement is that the 
mapping orbit FOV be clear as the Mars Observer moves into and out of 
occultation at the Martian limb. Extensive geometry studies involving 
mission date, position in the orbit, solar array position, and gimbal axes 
orientations were conducted to ensure that this would be the case. 

One output of the studies was the boom length requirement of 3.81 m (150 
inches) in the mapping orbit. To satisfy this length the boom is 
fabricated in two sections joined by a 180° hinge. The inboard boom is 
hinged to the zenith side of the spacecraft, and when fully deployed in 
the mapping orbit, the entire boom extends in the zenith direction. 
Figure 2-9 shows the boom in its stowed, cruise and mapping orbit 
configurations. 

The antenna is attached to the gimbal system which in turn is joined to 
the outboard end of the outboard boom. During launch the inboard boom is 
latched to the nadir end of the spacecraft structure. A boom-mounted 
fitting is pinned to a toggle link that is secured to a spacecraft fitting 
by a pair of pyrotechnic pin pullers (Figure 2-11). Actuation of either 
pin puller will produce a successful release. The same system was used to 
release the solar arrays on RCA's ITOS series of meteorology satellites. 
Adjustable standoffs stabilize the antenna itself during launch. 

Deployment is initiated in the cruise phase by firing the pin pullers 
securing the outboard boom/gimbal assembly. Redundant laminated negator 
springs, assisted initially by short stroke kickoff springs, provide the 
deployment energy, and rotary viscous dampers limit the angular velocity. 
An end-of -travel latch incorporates a cam feature which eliminates 
backlash. In this position the gimbal system is operable, and the antenna 
has a clear view of earth during cruise. After injection into Mars 
phasing orbit, the large bipropellant engines are deactivated, and their 
loads are no longer applied to the spacecraft. The inboard boom's 
restraining pin pullers are fired and the entire HGA and boom are rotated 
to the zenith position using the same spring/damper/latch design as for 
the mid-point hinge. This assembly is the same temperature-controlled 
design described previously for the solar array. Rotary waveguide joints 
at the hinges provide RF continuity. 
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Figure 2-10. Nova and Dynamics Explorer Booms. 
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The HGA boom is a tubular graphite/epoxy laminate 6.35 cm (2.5 inches) in 
diameter x 1.52 mm (.060 inch) wall thickness. The material is cured in a 
quasi-isotropic pattern to approach a zero coefficient of thermal 
expansion. Sensitivity to thermal distortion is further reduced by 
enclosing the boom in a multilayer insulation blanket. 

2.5.4 Separation Clamp Band 

The separation clampband, identical to that of Satcom Ku-Band, joins the 
spacecraft and upper stage adapter from final integration until after 
separation from the upper stage is commanded. Two semicircular steel 

bands are tensioned by a pair of diametrically opposed bolts to apply 
radial pressure to 14 V-blocks which compress mating rings in the 
spacecraft and adapter. Each ring has a 15° ramp angle at the V-bloc 
interface, which produces an axial compressive force from the radial 
force. The combination of this ramp angle and 36.030N (8100 lb) of 
preload in the tensioning bolts produce an axial force great enough to not 
only overcome the tension forces produced by spacecraft bending but also 
to prevent gapping between the mating rings. 

The band halves terminate in "bathtub" fittings which are joined by the 
separation bolts. Spherical washers on each bathtub prevent high bending 
loads from occurring in the separation bolt. 

Separation is effected by firing a bolt cutter at each bolt, only one of 
which is required for successful release. The strain energy of the band 
combined with 10 springs on the adapter pull the band halves radially 
outward and free of the mated rings. A hard anodize finish on the clamped 
surfaces facilitates separation of the vee blocks. However, the 

contacting surfaces on the two rings are treated with irridite to ensure 
ample grounding between the spacecraft and adapter. 

2.5.5 Cabling 

The Mars Observer bus harness includes all cabling among bus components as 
well as between bus and GFP, between PDS and GFP body-mounted instruments, 
between NXT and CDU, and between the boom mounted instruments and the 
spacecraft. Flight harness fabrication will be fully compliant with the 
well-established RCA practices in design, materials, and component 
selection. Harness design will be governed by the following documents: 

JPL D-1673 Mars Observer Performance 
Assurance Provisions 

D0D-W-83575A Wiring harness, space vehicle 
design and testing, General 
Specification for 
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MIL— STO— 1 541 Electromagnetic Compatabi lity 
Requirements for Space Systems. 

These harness designs will be developed through the use of computer-aided 
harness analysis (CAESH). After initial routing is determined, this 
program will define the electrical performance of the harness in terms of 
resistance, voltage drops, and power losses. Additionally, complete mass 
properties data is provided in terms of bundle sized, weights, inertias, 
and segment CGs. The program works in conjunction with RCA's PRIME CAD 
system. 

The Mars Observer harness set is divided into the following subassemblies: 

o Bus Harness , which comprises two individual harnesses for improved 
partitioning and installation. 

o Shunt Harness , very similar to the Satcom K design. 

o RCS Harness , an extrapolation of Satcom K technology to reflect the 
additional RCS requirements of MO. 

o Payload Harness , built to instrument requirements, which interconnects 
payload elements with each other and with bus components. (Note: the 
Payload Harness will be provided to JPL to allow instrument acceptance 
testing, utilizing the flight instrument cables.) 

These harnesses are joined in the spacecraft with the interface 
connectors. This approach improves fit, shortens the design cycle, and 
greatly facilitates debug and test. All harnesses will be firmly 
supported by spacecraft structure to withstand the launch environment. 

Copper conductors are the baseline for all harnesses. However, on-going 
trades will be performed to evaluate the weight benefits which might be 
realized by using aluminum conductors, a technique presently employed on 
several RCA communications spacecraft. 
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2.6 Propulsion 


The Mars Observer Propulsion Subsystem is comprised of a bipropellant 
system for large delta-V maneuvers and a hydrazine system for the Mars 
mapping phase maneuvers. Schematic diagrams of the Mars Observer reaction 
control system are shown in figures 2-12 and 2-13. All active elements in 
the bipropellant and hydrazine systems are fully redundant. The system 
designs provide for isolation of any failed component by ground command, 
yielding a system with no single point failures. Thruster locations on 
the spacecraft are shown in figure 2-14. All thrusters are functionally 
redundant with latch valve isolation of thruster sets in the unlikely 
event of thruster leakage or failure. Propellant manifolding is designed 
to make all propellant available to any operating thruster set. Subsystem 
design includes redundant heaters, blankets, low emittance tape wrap, and 
thruster thermal protection which preclude any operational constraints due 
to the temperature environment. Long bi propellant system life is ensured 
by operation of this propulsion system in the blowdown mode after the Mars 
mapping orbit is achieved. The all -welded RCS construction provides leak 
free, structurally sound systems. The thruster requirements are well 
within proven steady-state burn and pulse capabilities. 

2.6.1 Bi propellant Propulsion System 

The bipropellant propulsion equipment consists of eight pressure-fed, 
liquid bipropellant, radiatively cooled, rocket engines and their 
propellant feed, storage, and pressurization systems. Monomethyl 
hydrazine (MMH) is used as fuel and Nitrogen Tetraoxide (N 2 O 4 ) with 
0.8% of nitrous oxide (NO), designated MON-1, as the oxidizer. The 
bipropellant system is designed to deliver more than 3.69 x 10& N-sec of 
impulse to the Mars Observer spacecraft. 

Helium pressurant is stored at 28.96 MPa in two nominal 0.475m diameter 
6A1-4-V titanium shell tanks with Kevlar 49 fiber load-bearing overwrap. 
Regulation of the helium is provided by two pressure regulators in series, 
one primary, the other standby. The regulator maintains the tanks at a 
maximum pressure of 1.79 MPa until after the Mars mapping insertion 
maneuver is completed. A pyrovalve then permanently isolates the helium 
supply so that the feed system is operated in a blowdown mode until 
mission completion. Propellants are stored in six spherical 6A14V 
titanium tanks, comprising four 0.564-m diameter Satcom Ku-Band heritage 
tanks, and two 0.935-m diameter tanks. The latter tanks are mounted in 
the spacecraft center core allocated to the solid apogee motor in Satcom 
Ku-Band. The nominal operating oxidizer to fuel mixture ratio of 1.65 for 
the 490N and 22N bipropellant thrusters permits oxidizer and fuel storage 
in tanks of equal volumetric capacity. Propellant is fed to the thrusters 
from the 0.94-m diameter tanks which contain propellant management devices 
( PMO) to maintain a gas-free propellant supply at the tank outlet whenever 
outflow is required. Redundant check valves in the pressurant 
distribution manifold isolate the ullage volumes of the two 0.935-m 
diameter tanks to prevent propellant liquid and vapor from migrating up 
the helium lines and intermixing. Two pair of 0.564-m diameter tanks are 
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Figure 2-12. Bipropellant Propulsion System Schematic Diagram. 
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Figure 2-13. Hydrazine Propulsion System Schematic Diagram. 


5-2852 


45 









interconnected on the gas side to equalize liquid flow from the tanks into 
the 0.935-m diameter tank. Liquid transfer between the 0.564-m diameter 
tanks is inhibited by check valves in the ullage lines. The flow of 
gas-free liquid into the 0.935-m diameter supply tank is ensured by the 
"bubble traps" designed into the 0.564-m diameter tank outlets. During 
thruster firings, the acceleration will settle liquid over the tank 
outlets. Four 490N and four 22N thrusters provide the system impulse 
capability. Nominal system operation is four 490N thrusters firing 
simultaneously for velocity-change burns. Three-axis control during these 
burns is accomplished by on-pulsing the appropriate 22N bipropellant and 
22N hydrazine thrusters. For the trajectory correction maneuvers which 
adjust the arrival conditions at Mars (TCM 2 through 4), the 22N 
bipropellant thrusters are used to provide finer control. These thrusters 
are also used to inject the spacecraft into a sun synchronous, quarantine 
orbit at the end of the mission. 

Positive containment of the pressurant during regulated propulsion system 
inactive periods is accomplished by grouping of parallel-redundant, 
normally-closed and normally-open pyrotechnic valves. Latching solenoid 
valves provide dual seal backup for the bipropellant thruster valves. 
Filters are placed immediately downstream of all pyro valves to trap any 
debris which might contaminate sensitive componments. Service valves 
which seal with redundant caps are located in the liquid and gas manifolds 
to facilitate system testing and launch servicing. Subsystem pressures 
and valve and tank temperature status are telemetered. Positive 
indication of thruster firing is provided by the thruster valve 
temperature readout and on-board accelerometers. 

Thermal control is accomplished with redundant propellant line, tank and 
component heaters. Passive thermal control is also provided by thermal 
blankets and tape wrap on lines and components. Redundant element heaters 
are used on all valves and on the propellant manifolds. The thermal 
control design maintains propellant temperatures within design limits. 
Stainless steel heat shields surround the 490N thrusters to protect the 
spacecraft structures from overheating as a result of direct radiation 
from the hot combustion chamber during burns. 

All joints between tubing, fittings, and components in the continuously 
pressurized portions of the propulsion subsystem are welded by the 
tungsten inert gas (TIG) method. This RCA fabrication technique provides 
proven, leak-free, structurally sound subsystems. 

2.6.2 Hydrazine Propulsion System 

The hydrazine system for Mars Observer is an extension of the propulsion 
subsystems flown to date on more than a dozen RCA Astro-built commercial 
communications satellites. 

Three 0.44-m diameter spherical tanks contained in the hydrazine system 
operate in a blowdown mode. Each tank contains helium pressurant and 
hydrazine propellant. Low-g propellant positioning is ensured by means of 
surface-tension propellant management devices (PMDs). The propellant load 
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is equally distributed among the three tanks, two of which are manifolded 
to the two redundant sets of attitude control and velocity change 
thrusters. Twelve 0.9N, hydrazine rocket engine assemblies (REAs) provide 
for momentum wheel desaturation and four 22N hydrazine REAs are used for 
3-axis control during delta-V maneuvers and for Mars mapping, orbit-trim 
maneuvers. All hydrazine thrusters have series redundant propellant 
valves. The 0.9N REAs were developed and qualified for the NASA/JPL 
Mariner-Jupiter-Saturn (Voyager) program and are flown on all current 
RCA-built Satcom, Spacenet, 6STAR, DBS, and ASC communications 
satellites. The 22N thrusters have been qualified and flown on Voyager, 
the Global Positioning Satellite, and extensively on the Lockheed P-95 
program. 

Filtration of the propellant to the thrusters in the hydrazine system is 
provided by high-capacity, latch valve inlet filters. Servicing is 
provided by manual propellant and pressurant service valves on each tank. 
Subsystem instrumentation includes two pressure transducers that measure 
delivery pressure to the thrusters. All latch valves have position 
switches for positive valve state determination. The thrusters have 
redundant chamber heaters. Thermocouples on each thruster provide 
telemetry data for ground verification of thruster temperature and 
operation. Telemetry signals are also provided for tank, line, and 
thruster valve temperatures. 


490 N BiPROPELLANT THRUSTERS 1-4 

22 N BIPROPELLANT THRUSTERS S-« 

22 N HYDRAZINE THRUSTERS 9-12 



Figure 2-14. Spacecraft Axis Conventions and Thruster Locations. 
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3.0 Ground Support Equipment 


This section describes the Ground Support Equipment (GSE) that will be 
used at the launch site to support final build-up, pre-launch checkout, 
and launch operations of the spacecraft. This GSE falls into two distinct 
categories, the Electrical Ground Support Equipment (EGSE), and the 
Mechanical Ground Support Equipment (MGSE). The GSE design, operation and 
heritage are discussed for each piece of equipment. The aspects of GSE 
design and operation that are safety critical are also discussed. The 
EGSE is presented in section 3.1. The MGSE is presented in section 3.2. 
Section 4.0 gives an overview of the conceptual Mars Observer spacecraft 
launch site ground operations scenario. 
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3.1 


Electrical Ground Support Equipment 


The EGSE is used to perform pre-launch checkout of the spacecraft (and 
it's EASE) and to perform command and monitoring of spacecraft systems 
through the T-0 umbilical. This equipment is an application of existing 
EGSE used for past and present RCA STS launched spacecraft (ASC, Satcom, 
G-Star, and STC-OBS). RCA and NASA have gained a great deal of experience 
in working with this equipment which will help to minimize the effort 
required to integrate this equipment with the KSC ground support system. 
This experience base will also help to minimize EGSE related safety issues 
and ground processing delays due to EGSE problems. 

3.1.1 Spacecraft Checkout Station (SCS) 

The SCS is a computer-driven system that contains all of the test 
equipment necessary to initiate spacecraft commands and to process 
spacecraft telemetry. The SCS also includes the rf stimuli and measuring 
equipment needed to measure the performance of the spacecraft rf 
components. The SCS is used at the launch site to perform initial 
spacecraft checkout, perform launch pad commanding, perform initial 
rehearsals of launch pad procedures, and monitor spacecraft safety and 
health status. 
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The initial spacecraft checkout consists of performing a System Electrical 
Performance Evaluation Test (SEPET) utilizing the SCS. This test is an 
abbreviated version of the three SEPETs that are performed at RCA during 
the spacecraft level verification phase. The initial SEPET is performed 
early in the spacecraft level verification phase, the Final SEPET is 
performed toward the end of this phase and just prior to spacecraft 
shipment to the launch site, and the Thermal Vacuum SEPET is performed 
while the spacecraft is undergoing thermal vacuum testing. These tasks 
will all be performed by the same SCS which will be used at the launch 
site for the Launch Site SEPET and pre-launch commanding. 

The SCS is shown in figure 3-1 and a diagram of the SCS rack layout is TBS 
at phase one. The floor space requirements and electrical power 
requirements will also be supplied at phase one. The SCS will be 
installed in the Mars Observer Payload Processing Facility (PPF) two weeks 
prior to the start of spacecraft PPF operations. This time is required to 
set up and checkout SCS and data links to other Launch Site Equipment 
(LSE) and to the mission operations network. 

3.1.2 Launch Site Equipment 

The primary purpose of the LSE is to provide an interface between the SCS 
and the Mars Observer spacecraft while the spacecraft is mated to the 
Upper Stage (TOS) in the Orbiter cargo bay. Other functions are to verify 
correct operations of the PPF/KSC interfaces and to provide spacecraft 
simulation such that all TOS-to-spacecraft interfaces can be verified 
prior to spacecraft integration with the TOS. The LSE consist of four 
separate subsystems: the SCS Interface Equipment (SCSIE), the Remote 

Located Equipment (RLE), the T-0 Umbilical Test Set (TUTS), and the 
Dynamic Spacecraft Simulator (DSS). 

A block diagram of the LSE system, shown in Figure 3-2, depicts the basic 
interconnections used from the SCS through the RLE to the spacecraft. At 
Kennedy Space Center (KSC) the SCS and CSIE are located in the PPF. The 
RLE is mounted in a 6FE cabinet in room 104 when the spacecraft is in the 
VPF, or in compartment 10A of the Mobile Launch Platform (MLP) when the 
spacecraft is in the orbiter bay. The interface between the PPF and VPF 
or the MLP consists of a video link supplied by NASA. In addition, the 
PPF supplies MUX-DEMUX equipment at both ends to handle a variety of 
signals over the link. The following signals will pass between the SCSIE 
and RLE over the link: 

o Telemetry - Two spacecraft baseband telemetry streams 
o Commands - One SCS-generated baseband command input to the spacecraft 
o Shuttle Interface Unit (SIU) and RLE discrete commands and bilevel 
status telemetry 

Interconnections between the SCSIE, the video link, and the RLE are made 
via patch panels supplied by KSC. The interface between the RLE and the 
spacecraft is via the T-minus-0 (T-0) umbilical cabling and the SIU, 
located in the cradle. As in the video link, interconnections between the 
RLE and the T-0 umbilical are made via patch panels supplied by KSC. The 
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connections between the T-0 umbilical and the SIU are via the Standard 
Mixed Cargo Harness (SMCH) and the cradle harness. 

The TUTS connects to the TOS side of the T-0 umbilical prior to the 
spacecraft being integrated with the Orbiter. It is housed in a portable, 
ruggedized container, operates from 120 Vac, and provides the following 
functions: 

o Tests of SCSIE and RLE operation at RCA or the launch site prior to 
shipment or installation using test cabling. 

o Tests of PPF and RLE operation after installation and connection to KSC 
interfaces, to validate the launch site interfaces. 

o Provides a means of troubleshooting the LSE or cabling and a means of 
training personnel without jeopardizing the spacecraft. 

The OSS tests the TOS-to-spacecraft interface with the SIU installed in 
the cradle while in the PPF. The OSS functions are housed in the same 
portable container as the TUTS, since they share some of the same 
circuitry and are not used at the same time. The OSS provides the 
following functions: 

o Simulate the spacecraft interface with the TOS. 

o Simulate the RLE interface with the T-0 umbilical. 

o Provide a means of testing the Cradle/SIU interfaces and the Cradle 
test set (Orbiter simulator) functions prior to mating with the 
spacecraft. 

The following sections provide more detailed descriptions of the Mars 
Observer LSE. 

3.1. 2.1 SCS Interface Equipment (SCSIE) 

The CSIE is housed in a sloped front, single-bay console, as shown in 
Figure 3-3 and is located in close proximity to the SCS cabinets. The 
SCSIE consists of two chassis: a chassis containing front panel displays, 

control switches and internal logic, and signal conditioning circuitry; 
and a data acquisition chassis. The data acquisitiion chassis multiplexes 
CSIE front panel switch commands onto a single output for transmission to 
the RLE for control of both RLE and SIU functions. It also demultiplexes 
analog and bilevel telemetry transmitted from the RLE for presentation on 
front panel displays. The CSIE provides the following functions: 

o Receive spacecraft PCM telemetry from RLE via microwave link and relay 
to the SCS after signal conditioning. 

o Receive spacecraft commands from the SCS, condition the signal, and 
transmit to RLE. 
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o Display voltage and current telemetry received from RLE for battery 
charge power supply located in RLE. 

o Receive and display RLE and SIU bilevel status telemetry. 

o Transmit discrete front panel switch commands for RLE and SIU to RLE. 


3. 1.2. 2 Remote Located Equipment 

The RLE consists of a standard 0.48-meter (19-inch), rack-mountable 
chassis as shown in Figure 3-4, designed for installation in a GFE rack 
cabinet in room 104 at the VPF or compartment 10A at the MLP. The RLE 
consists of three chassis: a chassis containing logic, relays, and signal 
conditioning circuitry; a 10 A battery charge power supply; and a data 
acquisition chassis. The data acquisition equipment multiplexes both 
analog and bilevel telemetry inputs from the RLE and SIU onto a single 
output for transmission to the CSIE. It also receives the discrete front 
panel switch commands generated at the CSIE and demultiplexes the commands 
into parallel relay closure type outputs for control of RLE or SIU 
functions. The RLE provides the following functions: 


o Receive SIU bilevel status telemetry via the T-0 umbilical and 
transmit to the CSIE. 
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o Receive spacecraft baseband telemetry from SIU via the T-0 
umbilical, condition the signal, and transmits to CSIE. 

o Monitor battery charge power supply voltage and current, and 
transmit to CSIE for display. 

o Receive discrete front panel switch commands from CSIE for SIU 
control, and transmit to SIU via the T-0 umbilical. 

o Provide up to 10A of battery charge current to the SIU via the T-0 
umbilical, remotely controlled from the CSIE. 

3. 1.2. 3 T-0 Umbilical Test Set (TUTSI 

The TUTS is housed in a portable container for ease of transport (see 
Figure 3.5). It mates with the TOS side of the T-0 umbilical and provides 
an accurate simulation of the spacecraft umbilical interfaces. Figure 3-6 
depicts the TUTS connected in the LSE KSC test configuration. It is 
self-contained and operates from 120 Vac. In conformance with KSC safety 
requirements it contains no internal power sources (batteries). All 
voltages within the unit can be turned off by a single front panel switch, 
and the unit can be used at least 30 feet from the Orbiter. The TUTS 
provides the following functions: 



Figure 3-5. DSS/TUTS. 
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Figure 3-6. TUTS Test Configuration. 
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o Generate simulated spacecraft PCM telemetry. 

o Decode and display SCS-generated spacecraft commands. 

o Provide resistive load for battery charge current from RLE 
power supply. 

o Provide resistive load and status indication of discrete commands 
generated by the RLE for the Sill. 

o Generate simulated SIU bilevel status telemetry via front panel 
switches. 

o Provide test points for all umbilical signals. 

3. 1.2. 4 Dynamic Spacecraft Simulator (0SS1 

The DSS is housed in the same portable container as the TUTS. It mates 
with the TOS/SIU and associated Test Set as shown in Figure 3-7. The DSS 
provides the following functions to simulate the spacecraft interface with 
the TOS: 

o Generate simulated spacecraft PCM telemetry. 

o Provide test points for strip charting commands to the spacecraft. 

o Provide a resistive load to simulate the spacecraft load on the SIU 
+28V dc/dc converter. 

o Provide status indicators and resistive loads for TOS timer discrete 
commands to the spacecraft. 

o Simulate spacecraft safety talk-back circuits using front panel 
switches. 



Figure 3-7. DSS Test Configuration. 
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o Provide simulation of spacecraft separation jumpers. 

The OSS provides the following functions to simulate the T-0 umbilical 

interface to the TOS: 

o Provide indications of SIU bilevel status telemetry. 

o Provide test points for monitoring spacecraft telemetry with an 
oscilloscope. 

o Generate uplink commands to spacecraft (via SIU) using front panel 
switches. 

o Provide up to 10 A of battery charge current to SIU 

o Provide simulation of discrete commands to the SIU using front 
panel switches. 

3. 1.2. 5 T-0 Umbilical Simulator 


TBS at Phase One 


3.1.3 Stray Voltage And Bridgewire Checker 

This piece of special test equipment (STE) performs two safety-related 
functions. These tests are performed in the Electromechanical Test 
Facility at Cape Canaveral Air Force Station (CCAFS). In the first mode, 
it is connected in turn to the various spacecraft pyrotechnic device 
firing terminals via a selector switch. This permits measurement of any 
stray or induced voltages produced across these terminal while other 
spacecraft tests are being conducted (such voltages could cause premature 
firing of the pyrotechnic devices). 

In the second mode, the STE is connected to the same firing terminals via 
the selector switch; however, now the resistance across those terminals is 
measured to ensure the integrity of the pyrotechnic devices safety 
bridgewires. This STE is small, battery powered, and housed in a rugged 
container. It incorporates a digital voltmeter and a digital, precision, 
low-current ohmeter. The design is derived from the current TIROS program 
unit, modified for the Mars Observer interfaces. 

3.1.4 Ordnance Device Simulator 

This STE is connected to the pyrotechnic device firing terminals to 
replace the firing squibs during the launch site SEPET. It uses precision 
circuit breakers to simulate the burnout of the squib when sufficient 
current is present for sufficient time. This STE is smal 1 , external ly 
powered, and housed in a rugged container. The self-test mode provides 
verification before use. This design is derived from the current TIROS 
program unit. 
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3.1.5 Thruster Simulator 


This STE is connected in lieu of the thrusters during propulsion system 
and attitude and articulation control system tests that are conducted as a 
part of the launch site SEPET. It displays and records changes of state 
in firing circuits to allow verification of thruster sequences. This STE 
is small, externally powered, and housed in a rugged container. The 
design is an adaptation of a DMSP unit. 
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3.2 Mechanical Ground Support Equipment 

The MGSE consists of the various fixtures required to handle the 
spacecraft at the launch site. As with the EGSE, the MGSE is an 
application of existing designs used on past and present RCA STS launched 
spacecraft (ASC, Satcom, G-Star, and STC-DBS). 

3.2.1 Spacecraft Workstand 

The spacecraft workstand provides a fixed bench that positions the body of 
the spacecraft at a convenient height for mechanical work activities while 
in the PPF. The spacecraft is attached to the workstand via a separation 
ring, as shown in figure 3-8. The existing spacecraft workstand from the 
Satcom program will be used for Mars Observer. 



Figure 3-8 Spacecraft Workstand. 


3.2.2 Spacecraft Vertical Lifting Fixture 

Prior to mating with the TOS upper stage, all spacecraft vertical lifting 
will be accomplished with the aid of the spacecraft Vertical Lifting 
Fixture. Hardpoints are designed into the bus structure that direct 
lifting loads into the center core. Lifting is accomplished through rods 
that thread into the hardpoints and attach to an overhead spreader 
suspended from the PPF/HPF bridge cranes. The rods are equipped with ball 
joints at each end to avoid bending moments. The Mars Observer program 
will make use of the same lifting fixture that was used on the Satcom 
Ku-Band program. In addition to use at the launch site, this fixture will 
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support all spacecraft vertical lifting operations at RCA. 

3.2.3 TOS Adaptor Simulator 

The TOS Adaptor Simulator is used to provide an interface between the 
spacecraft and the spacecraft workstand (see section 3.2.1) prior to 
mating with the TOS upper stage. This is the same adaptor that will be 
used at RCA to interface the spacecraft with the workstand and test 
fixtures. The Adaptor Simulator is shown mated to the spacecraft 
workstand in figure 3-8. The Adaptor Simulator for Mars Observer will be 
similar to the Satcom equivalent, with greater depth to provide clearances 
for the oxidizer tank and 110 Ibf thrusters. 

3.2.4 Workhorse Marmon Band 


This Marmon Band is a flight-type band that is used for handling and test 
only. The actual flight band is used for the TOS upper stage interface 
fit check and for the final mating of the spacecraft and TOS. 

3.2.5 Spacecraft Shipping Container 

An aluminum reusable shipping/storage container will be designed for Mars 
Observer spacecraft that will consist of a base, a suspension system, and 
a cover. The separation plane between cover and base will be low to 
afford maximum access to the spacecraft during installation and removal. 
The container will employ casters for mobility and extendable jacks that 
will off-load the casters during installation and removal operations and 
during storage periods. The suspension system is attached to the base 
through highly damped elastomeric shock absorbers, sized so that the 
natural frequency of the suspended item is significantly less than the 
first mode of the spacecraft. The suspension platform will contain an 
adapter that presents an interface to the spacecraft which is identical to 
that of the flight TOS adapter. A flight-type Marmon band will secure 
that spacecraft in an upright (Nadir panel down) position. No other 
attachments are made to the spacecraft, thus avoiding redundant load paths 
and/or indeterminate loads. The cover fully surrounds the spacecraft and 
attaches to the base through a bolted, gasketed joint. The cover is sized 
to provide generous clearance around the spacecraft to preclude impacting 
during transportation and inadvertent shock loading. Other features of 
the container are: 

o Thermostatically controlled heaters and an air conditioning system to 
maintain temperatures within prescribed limits during transportation. 

o Insulation lining the cover and base to minimize heat transfer. 

o A nitrogen supply and purge system used during transportation and 
periods of storage. 

o Shock, temperature, and humidity recorders. 


60 



o Relief valves to maintain pressure equilibrium during temperature or 
altitude transients. 

o Provisions to enable handling by crane or forklift. 

o All materials within the container chosen to maintain cleanroom 
conditions. 

In addition, a separate gasoline powered generator will be supplied to 
power the heaters and air conditioning system during highway 
transportation. 

3.2.6 Propulsion Subsystem Ground Servicing Equipment 

The propellant loading operation is made up of four phases in the 
following sequence: 

1. Hydrazine transfer from shipping drums to the N 2 H 4 vessel. This 

operation does not require the spacecraft and may be performed as a 
parallel operation to pre-loading launch preparations. 

2. NTO loading (Figure 3-9). 

3. N 2 H 4 loading (Figure 3-10). 

4. Pressurant loading (Figure 3-11). 

The propellant load carts that will be used for bipropellant and large 
spacecraft will be designed and built by RCA. The same design philosophy 
and manufacturing processes as used in a flight system will be adhered to 
when constructing the carts. All loading equipment will be tested prior 
to use at the launch facility. Testing will include proof pressure 
testing, and a functional test using NTO, N 2 H 4 , and GHE for the 
respective load carts. 

A schematic of the NTO load cart is presented in Figure 3-9. The NTO load 
cart consists of four major subassemblies: 

1 . NTO source 

2. Transfer panel subassembly 

3. Molecular sieve 

4. NTO drain tank 

The NTO source is baselined as the government furnished tank in which the 
NTO is supplied by Vicksburg Chemical. The transfer panel contains all 
valves and gauges required for loading operation. The molcular sieve is a 
titanium column containing LZ-Y82 pellets, a synthetic zeolite. The sieve 
serves to remove iron oxides in the NTO. The sieve uses a vent line with 
a sight glass to release any gas bubbles which might form both when fluid 
initially enters the load cart manifold and during the NTO loading 
operation. Since the venting gas will contain NO 2 , N 2 , and NTO fumes, 
it will be routed, using flex lines, to a facility vapor scrubber for 
decontamination. After being filtered, the NTO is loaded into the 
spacecraft via the spacecraft service valves. Propellant gauging during 
both the NTO and N 2 H 4 loading is accomplished by weight. The space- 
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craft will be mounted directly onto the scale platform. The weight will 
be monitored real time during the loading operation. 

Once the propellant tanks are loaded to the predicted requirement, the 
service valves are closed. This method will enable an accuracy ot +0.5 
pound of the entire propellant load. The scale is intrinsically safe for 
National Electrical Code Class I, Division 1, Group C and D location 
enabling it to be used in a hydrazine, monomethyl hydrazine, and nitrogen 
tetroxide loading operation. 

The high pressurant load panel is shown schematically in Figure 3-10, is 
used to both load gaseous helium pressurant and conduct the pressurant 
system proof test at the launch site. It utilizes an explosion proof 
pnuematic pump controlled by a high pressure control panel. The panel 
contains all valves and temperature and pressure monitors for the 
pressurant loading. Monitoring is continuous throughout the loading 
operation to avoid overheating the spacecraft pressurant components. 
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Figure 3-11. Pressurant Load Cart Schematic. 
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4.0 Ground Operations Scenario 


The launch operations sequence is shown in Figure 4-1. This figure shows 
the events asscociated with the spacecraft that will take place from the 
time the spacecraft arrives at the Eastern Test Range (ETR) through to 
launch. The sequence of events occur in the following four stages: 


1. Operations at the Spacecraft Checkout Facility (Payload Processing 
Facility) 


2. Operations at Explosive Safe Facilities 

3. Operations at Vertical Processing Facility 

4. Operations at Launch Complex 
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4.1 Prelaunch Operations 


The Mars Observer Spacecraft will be transported to the KSC via surface 
carrier in shipping containers and delivered to the Payload Processing 
Facility ( PPF ) for payload checkout and assembly. The Ground Support 
Equipment (GSE) for the Mars Observer spacecraft and the Airborne Support 
Equipment (ASE) will be delivered via air-ride truck. 

4.1.1 Payload Processing Facility (PPF) Operations 

Operations at this facility are primarily associated with the electrical 
checkout of the spacecraft as it arrives at ETR. The Spacecraft Checkout 
Station (SCS) will be located at this facility for all launch site 
operations. 

Activities at the PPF will include: 

a. Unpack and inspect 

b. Perform launch site Standard Electrical Performance and Evaluation 
Test (SEPET) 

c. Perform launch configuration test 

d. Perform squib circuit stray voltage test 

e. Perform spacecraft battery capacity test 

f. Perform spacecraft propulsion system pressure test 

During processing at the PPF, the STS will conduct an inspection of the 
spacecraft for sharp edges/corners/surfaces or protrusions which may 
damage an EVA crew members suit or associated equipment. Where possible, 
corrective action (tape, covers, standard teflon guard material, etc.) 
will be implemented. This inspection will be coordinated with JPL and 
corrective actions will be approved by JPL. 

The Mars Observer spacecraft will then be transported to the Hazardous 
Processing Facility (HPF) 

4.1.2 Payload Ordnance Processing Area Operations 

The Mars Observer ordnance will arrive at KSC via temperature-controlled 
air-ride van and be delivered to the Eastern Space and Missile Center 
(ESMC) contractor for storage in the payload ordnance processing area 
until scheduled for ordnance activities. RCA will supply KSC approved 
procedures to test and inspect all ordnance items. After approval by the 
KSC Safety Office, these procedures will be performed in the appropriate 
payload ordnance processing facility. The LSSM will schedule test dates 
and delivery of the ordnance to the facility with the ESMC contractor. 

4. 1.2. 2 Electrical-Mechanical Testing (EMT) Facility 

The Mars Observer bridge-wire resistance checks will be performed in the 
EMT facility. The ESMC contractor will accomplish the actual testing or 
inspections based on RCA procedures. 
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4. 1.2. 3 Missile Research Test Building (MRTB) 


Ordnance receiving inspections will be accomplished by RCA in the MRTB 
with ESMC contractor support. The TOS SRM receiving inspection and cold 
conditioning are also performed in this facility. 

4.1.3 Hazardous Processing Facility (HPF) 

The payload will enter the HPF for payload-unique hazardous operations. 
RCA is responsible for the hazardous operations performed in the HPF 
(after procedure approval) and for coordinating test activities and 
required support with the assigned LSSM. KSC is responsible for providing 
and scheduling the necessary and agreed-upon support. Hazardous 

operations will only be performed in the presence of a safety 

representative. Activities at the HPF shall include: 

a. Unpack and inspect 

b. Weigh spacecraft dry 

c. Load Propellants and pressurize with helium to flight pressure 

d. Weigh spacecraft (final, wet) 

e. Install ordnance 

The spacecraft will then be given to OSC for mating to its upper stage. 

4.1.4 Vertical Processing Facility (VPF) Operations 

The payload will be moved into the VPF airlock using an electric tug or 
the snatch blocks. All crane operations in the VPF will be performed by 
KSC cargo integration contractor personnel. After transportation, the 
container is cleaned and removed, and the cargo element will be moved into 
the high bay for rotation and insertion in the Vertical Payload Handling 
Device (VPHD). 

The Mars Observer/TOS cargo element will then be installed into the Cargo 
Integration and Test Equipment (CITE) and mechanical and electrical 
connections will be made in preparation for CITE testing. 

The purpose of CITE is to verify the interfaces to the Orbiter. The 

detailed requirements of the interfaces to be tested come from JSC as part 
of the Operation and Maintenance Requirements Specifications (OMRS) File 
II. Test plans and testing of the RF and subsystem test will be prepared 
by RCA in conjunction with NASA and the KSC cargo integration contractor. 

Integration and handling activities at the VPF will be under the overall 
management of NASA and KSC cargo integration contractor with all 
spacecraft/upper stage owners/contractors participating in test procedure 
development and implementation. RCA will be responsible for 
spacecraft-unique testing and for coordinating test activities with the 
LSSM. KSC is responsible for providing and scheduling agreed-upon support 
services. 
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During the cargo integration testing with CITE, safety control and monitor 
functions will be exercised. All hardwire connections from the Aft Flight 
Deck (AFD) and T-0 umbilicals will be verified. An abbreviated mission 
simulation will include prelaunch and predeployment sequences. 
Data/command links will be exercised and verified. The power transfer 
from Orbiter to payload/carrier will be demonstrated. Power-on and 
power-off stray voltage tests will check for stray voltage. The data will 
be reviewed in realtime prior to CITE disconnection. A Mars Observer 
end-to-end test with the remote POCC is planned to be conducted. 

The entire cargo will then be transferred from the VPHD into the payload 
canister for transportation to the pad. Environmental control will be 
provided enroute. The payload GSE will be transported separately by KSC. 

4.1.5 Orbiter Processing Facility (OPF) Operations 

The shuttle integration contractor is responsible for all installation and 
integration of the AFD equipment and other ASE with the Orbiter at the 
OPF. These procedures will be developed by the shuttle integration 
contractor with input from the user. 

4.1.6 Launch Pad Operations 

At the pad, the transporter will position the canister at ground level 
below the Rotating Service Structure (RSS) crane. The canister will be 
hoisted to the Payload Changeout Room (PCR) door level and locked into 
position. The PCR environmental seals will be inflated, and the space 
between the canister and PCR doors purged. The PCR and the canister doors 
will be opened sequentially; the cargo will be transferred out of the 
canister by the Payload Ground Handling Mechanism (PGHM) and into the 
PCR. The PCR and canister doors will be closed and the canister lowered 
and removed. A transportation inspection of the cargo will be performed. 

4.1.7 Orbiter Integrated Operations 

After the crawler transporter moves the shuttle to the pad and the Mobile 
Launch Platform (MLP) is positioned on the pad, the RSS will be rotated 
into position for transfer of the cargo into the Orbiter. The PCR 
environmental seals will be inflated; the cavity between the PCR doors and 
the Orbiter cargo bay doors will be purged, and the doors opened 
sequentially. The cargo will be installed in the Orbiter cargo bay by the 
shuttle integration contractor using the PGHM and secured. 

Prior to connecting the cargo-to-Orbiter electrical interfaces, power-off 
continuity and isolation/power-on voltage tests will be run to verify 
proper power system conditions. Then the interfaces will be mated and the 
elements will be powered to verify the interfaces. The testing will 
include interface verification and end-to-end tests. 

The same series of tests specified in paragraph 4.1.5 shall be repeated on 
the cargo unit when it is installed in the cargo bay. At the completion 
of the verification testing the flight arming plugs will be installed, and 
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final ordnance connections made. Then the payload GSE will be moved into 
the PCR, the Orbiter doors closed, and the RSS rotated to the launch 
position. 

After the cargo bay doors are closed, the spacecraft batteries will be 
brought up to a fully charged state. The fully charged state will be 

maintained by trickle charging. Control for charging will be through the 
T-0 umbilical. The primary power for charging will be from the Orbiter 
power bus with a backup through the T-0 umbilical. 

Shortly before launch, the momentum wheels will be turned on at low 
rotational speed (220 RPM) . This activity shall be done by commands 
through the T-0 umbilicals as controlled by the spacecraft checkout 
station located at the PPF. 
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4.2 Postlaunch Operations 


When pad access has been granted following the launch, the payload GSE 
will be packaged by the user for removal from the PCR. KSC will provide 
the handling and transportation support necessary to return the GSE to the 
PPF. 

At completion of activities in the PPF, RCA will package (with KSC 
assistance if required) all material. KSC will provide personnel and 
equipment to load the GSE onto transportation for return to the PPF 
facility. 
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4.3 Postlandinq Operations 


When the Orbiter lands at the KSC Shuttle Landing Facility, a payload bay 
purge of conditioned air will be connected and the Orbiter will be towed 
to the OFF. After Orbiter safing, the payload bay doors will be opened, 
and the ASE mounted on the TOS cradle will be disconnected, removed, and 
installed in transportation containers. KSC will transport the equipment 
to a previously designated KSC facility for refurbishment or return it to 
RCA. 
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4.4 Contingency Operations 


4.4.1 Prelaunch Abort 

Approval for conducting nonscheduled payload activities will be the result 
of a realtime decision involving the program participants. 

The payload is safed by: 

TBS at phase 1 

4.4.2 Return to Launch Site Abort 


In the event of an abort landing on KSC, the postlanding activities will 
be subject to orbiter contingency operations/planning based on the nature 
of the abort. The nominal planning calls for services to be established 
to the Orbiter within 15 minutes after landing. The Orbiter will then be 
towed to The OPF, safed, and payload bay doors opened. The cargo will be 
removed, safed, and placed in the canister. Then it will be taken to the 
Vehicle Assembly Building, rotated to the vertical, and taken to the VPF 
for cargo installation into the VPHD. The cargo will be deintegrated and 
the individual payloads returned to their respective HPF. 

4.4.3 Secondary and Contingency Landing Sites 

The overall activities required to safe the Orbiter, remove the payload, 
and return the Orbiter from a secondary/contingency landing site are 
outlined in KTV-PL-0014, "KSC Off-Site Operations Plan." 

The payload is safed by: 

TBS at phase 1 
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5.0 Requirements Matrix 


The Mars Observer Requirements Matrix is shown in figure 5-1. The 
requirements matrix descriptive data can be found on the pages that 
immediately follow figure 5-1. 
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STS PAYLOAO SAFETY REQUIREMENTS 
APPLICABILITY DESCRIPTIVE DATA 


MATRIX | 
ELEMENT | 

COMMENTS 

1 

1-219 | 

1 
1 
1 
| 

Refer to PHR 1 - Arcing of exposed powered electrical 
circuits and devices or payload temperatures greater than 
352°F could cause ignition of flammable atmosphere in cargo 
bay. 

1-213 | 

206 | 

1 

1 

1 

I 

Refer to PHR's 2, 3 f - Electrical faults such as shorts, 
grounds, overvoltages, or arcing resulting in damage to 
STS circuitry or malfunctioning of electrical thermal 
control devices causing ignition of adjacent Orbiter or 
payload flammable material. 

1-212.2 | 
i 
i 
i 
i 

i 

Refer to PHR 4 - Improper shielding and/or filtering of 
harnesses and spacecraft components causing spurious 
non-ionizing radiation in Orbiter Cargo Bay which 
exceeds levels specified in JSC 07700 Vol. XIV, 
Attachment 1 . 

1 

2-209.1 | 

-213 | 

1 

1 

I 

Refer to PHR's 5,6 - Loss of heaters which prevent propellant 
from freezing causing rupture of containers and/or lines and 
release of hydrazine. Heater failure causing temperature 
and/or pressure increases and formation of ignition sources. 

2-208.7 | 

-209.1 | 

i 

Refer to PHR 7 - Excessive pressure buildup of sealed con- 
tainers causing rupture of hardware releasing debris. 

1 

3-209.3 | 

1 

1 

I 

Refer to PHR 8 - Use of flammable materials in payload 
design or improper separation of them from ignition 
sources resulting in Orbiter or other payload damage. 

1 

3-209.1 | 

1 
1 
| 

Refer to PHR 9 - Use of non-compatible materials that 

may react and cause rupture of propellant tanks or lines and/or 

NiCd battery pressure vessel containers. 

4-205 | 

1 

1 

I 

Refer to PHR 11 - Failure of electrical circuitry resulting 
in unsafe conditions in the event of a contingency return 
of the payload and Orbiter. 

1 

4-202.2 | 

1 

Refer to PHR 12 - Failure of rotating equipment which causes 
the release of debris. 
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STS PAYLOAD SAFETY REQUIREMENTS 
APPLICABILITY DESCRIPTIVE DATA 


MATRIX 

ELEMENT 


4-202. 2C 
-202. 2D 


5-209.1 


5-208.4 

-208.5 


6-202. 2B 


7-210 


8-202. 2E 
- 212.2 


9-208.1 

-208.2 

-208.3 


COMMENTS 


Refer to PHR 13 - Premature deployment of payload appendages 
(antennas, solar arrays, booms) would prevent payload bay door 
closure and/or safe landing of the Orbiter. 

Refer to PHR 14 - Release of propellant from spacecraft tanks 
and/or lines due to leakage causing corrosion. 

Refer to PHR 15, 16 - Structural failure causing rupture 
of the propellant tanks and/or lines that releases debris 
or propellant damaging the Orbiter. Structural failure or 
electrical faults of the NiCd cells causing rupture releasing 
debris and/or electrolyte. 

Refer to PHR 17 - Premature firing of propulsion subsystem 
thrusters that causes collision of spacecraft with Orbiter or 
release of propellant in payload bay. 

Refer to PHR 18 - Premature firing of initiators could 
cause release of appendages resulting in collision. 

Refer to PHR 19 - Inadvertent operation of payload trans- 
mitters in excess of levels defined in JSC 07700 Vol. XIV, 
Attachment 1 is a catastrophic hazard. 

Refer to PHR 20 - Failure of structure or appendages may 
cause damage to the Orbiter. 

Refer to PHR 10 - Breakage of payload structure due to 
stress corrosion may damage the Orbiter. 
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6.0 Phase 0 Hazard Reports 

The Phase 0 Hazard Reports have been prepared as outlined in JSC-13830A, 
Implementation Procedure for STS Payloads System Safety Requirements, 
Revision A, dated May 16, 1983. The Mars Observer Safety Analysis has 
been performed using the guidelines of JSC-11123, Space Transportation 
System Payload Safety Guidelines Handbook, with Change 1, dated September, 
1978. The results of this analysis are presented here in the Phase 0 
hazard reports. 

Section 6.1 presents the Phase 0 hazard reports for flight operations. 
Section 6.2 presents the Phase 0 hazard reports for ground operations. 



6.1 Flight Payload Hazard Reports 


The Mars Observer Phase 0 Flight Payload Hazard Reports are dispositioned as 
follows. 
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PAYLOAD HAZARD REPORT 

| NO. FLIGHT: 1 

| GROUND: 

1 

PAYLOAD: Mars Observer 


| PHASE: 0 

1 

SUBSYSTEM: | HAZARD GROUP: 

Electrical I 

1 

Fire 

IDATE: 

| October 1986 

HAZARD TITLE: Ignition of Flammable Atmosphere 

APPLICABLE SAFETY REQUIREMENT: 

NHB 1700. 7A - 219 


1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 



Payload ignition of flammable atmosphere in cargo 
contingency landing of the STS. 

bay during abort and 


HAZARD CAUSES: 


1. Arcing of exposed powered electrical circuits and devices produced by 
making and/or breaking of electrical circuits or electrostatic discharge. 

2. Payload Temperatures greater than 352°F. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I | | 

PHASE II 1 1 

PHASE III 1 I 
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PAYLOAD HAZARD REPORT 

| NO . FLIGHT: 2 

| GROUND: 

1 

PAYLOAD: 

Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: 

| HAZARD GROUP: 
Electrical j 

1 

| DATE : 

j October 1986 

1 

HAZARD TITLE: Damage to STS Circuitry 

APPLICABLE 

SAFETY REQUIREMENT: 

NHB 1700. 7A - 213, 206 

1 HAZARD CATEGORY: 
1 1 CATASTROPHIC 
1 X 1 CRITICAL 


DESCRIPTION OF HAZARD: 


Fault in Payload damages STS circuitry. Hazard is critical since 
payload bay power is fused by Orbiter. 


HAZARD CAUSES: 

1. Internal payload electrical faults such as shorts, grounds, overvoltages, 
etc. that could cause overloading of STS circuitry. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 
PHASE I 
PHASE II 
PHASE III 


I PAYLOAD ORGANIZATION 1 

] L 

J l 

] l 


STS 
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PAYLOAD HAZARD REPORT 

| NO. FLIGHT: 3 

j GROUND: 

1 

PAYLOAD: 

Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: 

| HAZARD GROUP: 

Electrical j Fire 

1 

IDATE: 

j October 1986 

1 

HAZARD TITLE: Thermal Ignition Source 

APPLICABLE 

SAFETY REQUIREMENT: 

NHB 1700. 7A - 213 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 


DESCRIPTION OF HAZARD: 


Generating sufficient heat from payload electrical circuits to ignite 
adjacent orbiter or payload flammable material. 


HAZARD CAUSES: 

1. Internal shorts or arcing in electrical circuitry. 

2. Malfunction of electrical thermal control devices. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I I I 

PHASE II 1 I 

PHASE III 1 I 


83 












PAYLOAD HAZARD REPORT 

| NO. FLIGHT: 4 

| GROUND: 

PAYLOAD: 

Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: 

| HAZARD GROUP: 

Electrical j Radiation 

1 

| DATE: 

j October 1986 

HAZARD TITLE: Susceptibility To Electromagnetic Radiation 

APPLICABLE 

SAFETY REQUIREMENT: 

NHB 1700. 7A - 212.2 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 


DESCRIPTION OF HAZARD: 


Spurious non-ionizing radiation from the Orbiter, copassenger payloads, or the 
MO spacecraft while in Orbiter Cargo Bay exceeding levels specified in JSC 
07700 Vol. XIV, Attachment 1 during normal payload operation. 

(NOTE: Radiation from antennas is covered in Payload Hazard Report 19, 

"Excess Transmitter Radiation.") 


HAZARD CAUSES: 

1. Radiation of energy from the Orbiter, copassenger payloads, or the 

spacecraft components which adversely effects the MO spacecraft due to 
improper shielding or improper filtering of the MO spacecraft components. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 

1 PAYLOAD ORGANIZATION 1 

STS 

PHASE I 1 1 

PHASE II 

1 l 


PHASE III 1 1 
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| NO. FLIGHT: 5 


PAYLOAD HAZARD REPORT 

| GROUND: 

1 

PAYLOAD: Mars Observer 


| PHASE: 0 

1 

SUBSYSTEM: 

| HAZARD GROUP: Temperature 

| DATE : 


Environmental Control | Extremes | October 1986 


HAZARD TITLE: Temperature Extremes (Low) 


APPLICABLE SAFETY REQUIREMENT: 

1 HAZARD CATEGORY: 

NHB 1700. 7A - 209.1a, 213 

1 XI CATASTROPHIC 


1 1 CRITICAL 


DESCRIPTION OF HAZARD: 


Low temperature extremes could result in the release of hazardous material 
(propellant) . 


HAZARD CAUSES: 

1. Loss of heaters that could allow freezing of payload fluids to such an 
extent that containers and/or lines could rupture. Propellant tanks or 
lines are the only possible items. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 

1 PAYLOAD ORGANIZATION 1 

STS 

PHASE I 

1 1 


PHASE II 1 1 

PHASE III ! 1 
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PAYLOAD HAZARD REPORT 

| NO . FLIGHT: 6 

| GROUND: 

PAYLOAD: Mars Observer 


| PHASE: 0 

SUBSYSTEM: | HAZARD GROUP: 

Environmental Control | 

1 

Temperature 

Extremes 

| DATE : 

| October 1986 

HAZARD TITLE: Temperature Extremes (High) 

APPLICABLE SAFETY REQUIREMENT: 


1 HAZARD CATEGORY: 

NHB 1700. 7A - 209.1a, 213 


1 XI CATASTROPHIC 



1 1 CRITICAL 

DESCRIPTION OF HAZARD: 



High temperature extremes could cause the release 
(propellant) or the formation of ignition sources 

of hazardous 

material 


HAZARD CAUSES: 


1. Failure of a heater in On position that could cause high temperatures, 
resulting in propulsion system pressure increases or the formation of 
ignition sources. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I | | 

PHASE II | I 

PHASE III | I 
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PAYLOAD HAZARD 

REPORT 

(NO. FLIGHT: 7 

j GROUND: 

1 

PAYLOAD: 

Mars Observer 


| PHASE: 0 

1 

SUBSYSTEM: 

| HAZARD GROUP: 

| DATE : 


Environmental Control | 

1 

Contamination! October 1986 

1 

HAZARD TITLE: Rupture of Sealed Containers 

During Ascent 

or Descent 

APPLICABLE 

SAFETY REQUIREMENT: 


1 HAZARD CATEGORY: 


NHB 1700. 7A - 208.7, 

209.1 

1 1 CATASTROPHIC 

1 X 1 CRITICAL 


DESCRIPTION OF HAZARD: 


Rupture of sealed containers releasing debris. The sealed containers are the 
RWA's and small relays internal to subsystem boxes. 


HAZARD CAUSES: 

1. Excessive pressure buildup in sealed containers. 

2. Undetected flaws or cracks. 

3. Physical damage during handling. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I 1 1 

PHASE II | I 

PHASE III I I 
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| NO . FLIGHT: 8 


PAYLOAD HAZARD REPORT 

| GROUND: 

PAYLOAD: Mars Observer 


| PHASE: 0 

1 


SUBSYSTEM: | HAZARD GROUP: | DATE: 

Materials I Fire | October 1986 

I I 


HAZARD TITLE: Flammability of Materials 


APPLICABLE SAFETY REQUIREMENT: 

NHB 1700. 7A - 209.3 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 

Orbiter Damage or other payload damage due to ignition of flammable materials. 

HAZARD CAUSES: 

1. Use of flammable materials in payload design. 

2. Improper separation of flammable materials from potential 

ignition sources. 

HAZARD CONTROLS: 



SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I I 1 

PHASE II 1 I 

PHASE III l | 


t-V 
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| NO. FLIGHT: 9 


PAYLOAD HAZARD REPORT 

| GROUND: 

1 

PAYLOAD: Mars Observer 



| PHASE: 0 

1 

SUBSYSTEM: 

| HAZARD GROUP: 

Fire 

| DATE: 

Materials 

1 

1 

Contamination 

Corrosion 

| October 1986 
1 

HAZARD TITLE: Hazardous 

Materials Compatibility 



APPLICABLE SAFETY REQUIREMENT: 


1 HAZARD CATEGORY: 

NHB 1700. 7A - 209.1 


1 XI CATASTROPHIC 




1 1 CRITICAL 


DESCRIPTION OF HAZARD: 


Reaction of containing materials with hazardous fluids, specifically hydrazine 
tanks and NiCd battery pressure vessel containers. 


HAZARD CAUSES: 

1. Use of non-compatible materials that may react. 
HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 

1 PAYLOAD ORGANIZATION I 

STS 

PHASE I 1 1 

PHASE II 1 1 

PHASE III 

1 1 
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PAYLOAD HAZARD REPORT 

| NO. FLIGHT: 10 

| GROUND: 

1 

PAYLOAD: Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: | HAZARD GROUP: 

Structures j Corrosion 

1 

| DATE : 

j October 1986 

HAZARD TITLE: Stress Corrosion Structural Weakening 

APPLICABLE SAFETY REQUIREMENT: 

NHB 1700. 7A - 208.3 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 


Damage to the Orbiter due to breaking of structural parts of the payload. 

HAZARD CAUSES: 


1. Stress Corrosion of payload structural materials weakening 
design limits. 

them past their 


HA^AkO CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I | 1 

PHASE II | 1 

PHASE III | | 
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PAYLOAD HAZARD REPORT 

| NO - FLIGHT: 11 

| GROUND: 

1 

PAYLOAD: Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: | HAZARD GROUP: Loss of 

Mechanical I Orbiter Entry Capability 

1 

| DATE : 

| October 1986 

J 

HAZARD TITLE: Contingency Return Considerations 

APPLICABLE SAFETY REQUIREMENT: 

1 HAZARD CATEGORY: 

NHB 1700. 7A - 205 

1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 


Spacecraft failure prior to or during contingency return or abort causing 
damage to the Orbiter. 

HAZARD CAUSES: 


1. Spacecraft may be in deployment mode configuration and otherwise 
electrically unsafe. 

2. Buildup of temperature within the orbiter bay. 

3. Possible high landing loads. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION 1 STS 

PHASE I 1 | 

PHASE II 1 | 

PHASE III I I 
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| NO. FLIGHT: 12 

PAYLOAD HAZARD REPORT | GROUND: 


PAYLOAD: Mars Observer | PHASE: 0 

I 

SUBSYSTEM: I HAZARD GROUP: | DATE : 

Mechanical j Collision j October 1986 


HAZARD TITLE: Rotating Equipment 


APPLICABLE SAFETY REQUIREMENT: I HAZARD CATEGORY : 

NHB 1700. 7A - 202.2 I XI CATASTROPHIC 

I I CRITICAL 

DESCRIPTION OF HAZARD: 

Debris from rotating equipment failure could damage Orbiter. The RWA's and 
gyro assemblies are possible rotating equipment that could fail. 


HAZARD CAUSES: 

1. Failure of rotating equipment (reaction wheels and/or gyro assemblies) 
during STS launch or deployment operations releasing debris. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 

1 PAYLOAD ORGANIZATION 

1 

STS 

PHASE I 1 1 

PHASE II 

1 

1 


PHASE III 1 1 
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PAYLOAD HAZARD REPORT 

| NO. FLIGHT: 13 

| GROUND: 

1 

PAYLOAD: Mars Observer 


| PHASE: 0 

1 

SUBSYSTEM: 

Mechanical 

| HAZARD GROUP: 

! Collision 

L_ 

| DATE : 

| October 1986 

HAZARD TITLE: Premature Deployment 

APPLICABLE SAFETY REQUIREMENT: 

NHB 1700. 7A - 202. 2C, 202. 2D 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 



Premature deployment of 
door closure and/or safe 

spacecraft appendages that may prevent payload bay 
landing of Orbiter. 

HAZARD CAUSES: 



1. Premature release of solar panel restraint bands. 

2. Premature deployment of the high gain antenna. 

3. Premature deployment of an instrument boom. 



HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION 1 STS 

PHASE I 1 | 

PHASE II 1 | 

PHASE III 1 1 
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| NO. FLIGHT: 14 

PAYLOAD HAZARD REPORT | GROUND: 

1 

PAYLOAD: Mars Observer 

| PHASE: 0 

1 


SUBSYSTEM: Pressure IHAZARD GROUP: Contamination | DATE: 

Systems j Corrosion j October 1986 

| Fire | 


HAZARD TITLE: Leakage of Hazardous Fluids 


APPLICABLE SAFETY REQUIREMENT: 

NHB 1700. 7A - 209.1a 

IHAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 


Release of propellant (MON-1, MMH, N 2 H 4 ) from spacecraft's 
subsystem damaging the Orbiter. 

propulsion 

HAZARD CAUSES: 



1. Leakage of propellant from seals, valves, or connections due to material 
defect, degradation, undetected damage, or weld failure. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 

i PAYLOAD ORGANIZATION ! 

STS 

PHASE I 1 1 

PHASE II ! i 

PHASE III 

1 1 



94 













| NO. FLIGHT: 15 

PAYLOAD HAZARD REPORT | GROUND: 

I 

PAYLOAD: Mars Observer | PHASE: 0 

I 

SUBSYSTEM: Pressure | HAZARD GROUP: Contamination! DATE: 

Systems j Corrosion j October 1986 


HAZARD TITLE: Rupture of Pressure Vessels 


APPLICABLE SAFETY REQUIREMENT: 

NHB 1700. 7A - 208.4, 208.5 


DESCRIPTION OF HAZARD: 


| HAZARD CATEGORY: 
I XI CATASTROPHIC 
I I CRITICAL 


Rupture of pressure vessels releasing debris or propellant (MON-1, MMH, 
N 2 H 4 ) into the payload bay that could damage the Orbiter. 


HAZARD CAUSES: 

1. Structural failure of propellant tanks or lines due to material defects, 
degradation, undetected damage, weld failure, or insufficient factor of 
safety in the design causing rupture rupture of tanks and/or lines which 
could result in the release of propellant. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I | | 

PHASE II | | 

PHASE III | | 
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PAYLOAD HAZARD REPORT 

NO. FLIGHT: 16 

GROUND: 

PAYLOAD': Mar$ Observer 

PHASE: 0 

SUBSYSTEM: Pressure IHAZARD GROUP: Contamination 

Systems j Corrosion 

1 

DATE: 

October 1986 

HAZARD TITLE: Rupture of NiCd Batteries 


APPLICABLE SAFETY REQUIREMENT: I HAZARD CATEGORY: 

NHB 1700. 7A - 208.4, 208.5 I XI CATASTROPHIC 

I I CRITICAL 


DESCRIPTION OF HAZARD: 

Rupture of the NiCd battery cells, releasing debris and/or electrolyte. 


HAZARD CAUSES: 

1. Structural failure of the NiCd cells. 

2. Overpressurization caused by internal or external short, cell reversal, 
overcharging, temperature extremes, or battery plate insulator failure. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 
PHASE I 
PHASE II 
PHASE III 


PAYLOAD ORGANIZATION I SJS 

I 

| 

I 
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PAYLOAD HAZARD REPORT 

| NO . FLIGHT: 17 

| GROUND: 

1 

PAYLOAD: Mars Observer 

| PHASE: 0 

. 1 

SUBSYSTEM: | HAZARD GROUP: 

Propulsion j Collision 

: 1 

| DATE : 

| October 1986 



HAZARD TITLE: Propulsion Subsystem 

APPLICABLE SAFETY REQUIREMENT: 

NHB 1700. 7A - 202.2b(l), 209-la, 213 

I HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 


1. Premature firing of the propulsion subsystem thrusters. 

2. Heating of propellant to hazardous temperature levels. 



HAZARD CAUSES: 


1. Failure of the propulsion subsystem or inadvertent commanding that allows 
flow of propellant to the thrusters. 

2. Relay failure causing a latch valve coil to be continuously energized. 
This would heat the latch valves and raise the temperature of the 
propellant adjacent to them. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I 1 ] 

PHASE II | I 

PHASE III | I 
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PAYLOAD 

HAZARD REPORT 

| NO . FLIGHT: 18 

| GROUND: 

1 

PAYLOAD: Mars Observer 



| PHASE: 0 

1 

SUBSYSTEM: 

Pyrotechnics 

| HAZARD GROUP: 

| Collision 

1 

| DATE: 

| October 1986 
1 

HAZARD TITLE: Inadvertent 

Firing of 

Initiators 


APPLICABLE SAFETY REQUIREMENT: 

NHB 1700. 7A - 

210 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 


Firing of initiators could cause inadvertent release of restraints on 
appendages, causing collision of the spacecraft with the Orbiter. 


HAZARD CAUSES: 

1. Premature firing of initiator due to stray EMI. 

2. Failure in fire control circuitry. 

3. Explosion of initiator. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 

1 PAYLOAD ORGANIZATION 1 

STS 

PHASE I 1 1 

PHASE II 

1 1 


PHASE III 1 1 
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| NO. FLIGHT: 19 


PAYLOAD HAZARD REPORT 

| GROUND: 

1 

PAYLOAD: Mars Observer 


| PHASE: 0 

1 


SUBSYSTEM: | HAZARD GROUP: (DATE: 

Communications j Radiation j October 1986 

I i 


HAZARD TITLE: Excess Transmitter Radiation 


APPLICABLE SAFETY REQUIREMENT: 

1 HAZARD CATEGORY: 

NHB 1700. 7A - 202. 2e, 212.2 

1 XI CATASTROPHIC 


1 1 CRITICAL 

DESCRIPTION OF HAZARD: 

Exposure of the Orbiter to RF radiation in excess of 

JSC 07700 Vol . XIV. 


HAZARD CAUSES: 


1. Inadvertent operation of RF transmitters causing radiation from 
transmitters in excess of permitted levels. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHOOS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I 1 I 

PHASE II 1 1 

PHASE III I I 
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PAYLOAD HAZARD REPORT 

| NO . FLIGHT: 20 

| GROUND: 

1 

PAYLOAD: 

Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: 

| HAZARD GROUP: 

Structures | Collision 

1 

| DATE: 

| October 1986 

HAZARD TITLE: Structural Failures 

APPLICABLE 

SAFETY REQUIREMENT: 

NHB 1700. 7A - 208.1, 208.2, 208.3 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 


DESCRIPTION OF HAZARD: 


Failure of the primary spacecraft structure or failure of critical 
appendages causing movement of the payload or appendages in the 
orbiter bay which may cause orbiter damage. 


HAZARD CAUSES: 

1. Insufficient factor of safety 

2. Fracture growth 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I | 1 

PHASE II 1 1 

PHASE III 1 | 
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6.2 Ground Payload Hazard Reports 


The Mars Observer Phase 0 Ground Payload Hazard Reports are dispositioned as 
follows. 


Table of Contents 


PHR# 

Subsystem 

Hazard Title 

Paqe 

1 

Electrical 

Electrical Hazards (Electric Shock) 

102 

2 

Structures 

Failure of Lifting and/or Handling Equipment 
During Ground Operations 

103 

3 

Propulsion. 

Inadvertent Release of Propellant Due to 
Leakage/Rupture 

104 

4 

Materials 

Loss of Habitable/Breathable Atmosphere 

105 

5 

Pyrotechnics 

Inadvertent Ignition of Pyrotechnics 

106 

6 

Communications 

Hazardous Levels of Radiation 

107 

7 

Electrical 

Ignition of Flammable Materials 

108 

8 

Pyro. /Propul si on 

Postlanding Operations - Aborted Mission 

109 

9 

Pressure Sys. 

NiCd Batteries Hazards 

no 

10 

Propulsion 

Inadvertent Firing or Leakage Through 
Thrusters 

111 

11 

Mechanical 

Rotating Equipment 

112 
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PAYLOAD HAZARD REPORT 

| NO. FLIGHT 
| GROUND: 1 

. 1 

PAYLOAD: Mars Observer 

| PHASE: 0 

. 1 

SUBSYSTEM: | HAZARD GROUP: 

Electrical j Electrical Shock 

1 

I DATE: 

| October 1986 

HAZARD TITLE: Electrical Hazards 

APPLICABLE SAFETY REQUIREMENT: 

KHB 1700. 7A - 4.3.2 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 


Potential electrical shock hazard to operating personnel. 


HAZARD CAUSES: 


1. Inadequate fault protection/detection in the Spacecraft 
(SCS) Design, other GSE, or the spacecraft. 

2. Improper installation, assembly, operator error, etc. 

Checkout Station 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 
PHASE I 
PHASE II 
PHASE III 


I PAYLOAD ORGANIZATION 1 SJS 
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PAYLOAD HAZARD REPORT 

| NO. FLIGHT: 

| GROUND: 2 

1 

PAYLOAD: Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: | HAZARD GROUP: Collision 

Mechanical | Injury 

1 

| DATE: 

| October 1986 
1 

HAZARD TITLE: 

Failure of Lifting and/or Handlinq Equipment Durinq Ground 

Operations 

APPLICABLE SAFETY REQUIREMENT: 

1 HAZARD CATEGORY: 

KHB 1700. 7A - 4.5.1 

1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 


Inadvertent dropping of Spacecraft could result in equipment damage and/or 
personnel injury during handling operations. 


HAZARD CAUSES: 


1. Handling equipment failure due to insufficient factor of safety. 

2. Improper rigging and/or procedures in using 
handling equipment. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 

1 PAYLOAD ORGANIZATION 1 

STS 

PHASE I 1 1 

PHASE II 

1 1 


PHASE III 1 1 
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PAYLOAD HAZARD 

REPORT 

| NO . FLIGHT: 

| GROUND: 3 

1 

PAYLOAD: 

Mars Observer 


| PHASE: 0 

1 

SUBSYSTEM: 

| HAZARD GROUP: Injury 

Propulsion j Contamination 

! Illness 

| DATE: 

j October 1986 

HAZARD TITLE: 

Release of Propellant 

APPLICABLE 

SAFETY REQUIREMENT: 


1 HAZARD CATEGORY: 


KHB 1700. 7A - 4.3.3, 

4.3.7 

1 XI CATASTROPHIC 
1 1 CRITICAL 


DESCRIPTION OF HAZARD: 


Rupture and/or leakage of the propulsion subsystem or propulsion GSE tanks 
and/or lines releasing propel lant/pressurant (MON-1, MMH, N 2 H 4 , Helium) 
which could cause personnel injury or illness from debris or depletion of 
breathable atmosphere. 


HAZARD CAUSES: 

1. Leakage of propellant through propulsion subsystem/propulsion GSE valves 
or connections. 

2. Fluid spills due to improper loading procedures. 

3. Structural failure of tanks and/or lines of the propulsion 
subsystem/propulsion GSE. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I | | 

PHASE II | | 

PHASE III I I 
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PAYLOAD HAZARD REPORT 

I NO . FLIGHT: 

I GROUND: 4 

1 

PAYLOAD: Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: | HAZARD GROUP: | DATE: 

Materials | Contamination j October 1986 

1 1 

HAZARD TITLE: Loss of Habitable/Breathable Atmosphere 

APPLICABLE SAFETY REQUIREMENT: 

KHB 1700. 7A - 4. 4. 2. 2 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 


Inhalation or ingestion of beryllium or other toxic fumes 
leading to personnel illness. 

and/or particulates 


HAZARD CAUSES: 


1. Welding, cutting, or machining operations performed on beryllium 
components. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 
PHASE I 
P HASE II 
PHASE III 


PAYLOAD ORGANIZATION I 

L 

L 


STS 
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PAYLOAD HAZARD REPORT 

| NO . FLIGHT: 

| GROUND: 5 

1 

PAYLOAD: Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: | HAZARD GROUP: Injury 

Pyrotechnic j Fire 

1 

| DATE : 

| October 1986 

HAZARD TITLE: Inadvertent Ignition of Pyrotechnics 

APPLICABLE SAFETY REQUIREMENT: 

KHB 1700. 7A - 4. 3. 5. 2, 4. 3. 5. 3, 4. 3. 5.4 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 [CRITICAL 

DESCRIPTION OF HAZARD: 


Inadvertent ignition of ordnance could result in equipment damage, personnel 
injury or fire. 


HAZARD CAUSES: 


1. Inadvertent application of power to EED's due to improper installation/ 
handling, inadvertent command, operator error, or test equipment failure. 

2. Stray voltages on ordnance power lines during checkout. 

3. Electrostatic discharge from static charge build up. 

4. Electromagnetic Interference (EMI) from spacecraft or in the vicinity of 
the spacecraft. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 1 PAYLOAD ORGANIZATION I STS 

PHASE I 1 | 

PHASE II | 1 

PHASE III I I 
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| NO. FLIGHT: 


PAYLOAD HAZARD REPORT 

| GROUND: 6 

1 

PAYLOAD: Mars Observer 


| PHASE: 0 

1 


SUBSYSTEM: | HAZARD GROUP: | DATE : 

Communications j Radiation j October 1986 


HAZARD TITLE: Hazardous Levels of Radiation 


APPLICABLE SAFETY REQUIREMENT: 

1 HAZARD CATEGORY: 

KHB 1700. 7A - 4.3.4 

1 1 CATASTROPHIC 


1 X 1 CRITICAL 

DESCRIPTION OF HAZARD: 

Communication Transmitter emits level of radiation hazardous 

to personnel. 


HAZARD CAUSES: 


1. Personnel present within range of hazardous radiation when transmitter 
is On. 

2. Inadvertent transmitter activation. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I 1 | 

PHASE II | | 

PHASE III 1 I 
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PAYLOAD HAZARD REPORT 

| NO. FLIGHT: 

| GROUND: 7 

1 

PAYLOAD: Mars Observer 


| PHASE: 0 

1 

SUBSYSTEM: 

Electrical 

| HAZARD GROUP: Fire 

j Explosion 

1 

| DATE : 

| October 1986 

HAZARD TITLE: Ignition of 

Flammable Materials. 


APPLICABLE SAFETY REQUIREMENT: 

KHB 1700. 7A - 4. 3. 2. 3, 4.3.9 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
i 1 CRITICAL 


DESCRIPTION OF HAZARD: 


Ignition sources in the presence of flammable material during spacecraft 
electrical checkout operations could cause a fire or explosion resulting in 
damage to equipment, facilities and/or personnel injury. 


HAZARD CAUSES: 

1. Electrical fault resulting in ignition of flammable materials. 

2. Use of flammable materials in spacecraft design. 

HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I | | 

PHASE II 1 1 

PHASE III | | 
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PAYLOAD HAZARD REPORT 

I NO. FLIGHT: 

| GROUND: 8 

1 

PAYLOAD: Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: Pyrotechnics | HAZARD GROUP: Injury 

Propulsion j Fire 

1 

| DATE: 

| October 1986 

1 

HAZARD TITLE: Postlanding Operations - Aborted Mission 

APPLICABLE SAFETY REQUIREMENT: 

KHB 1700. 7A - 4.3.5, 4.3.7 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 1 CRITICAL 

DESCRIPTION OF HAZARD: 


Premature ignition of ordnance during removal of a cargo element after an 
aborted mission could result in equipment damage, personnel injury, or fire. 


HAZARD CAUSES: 

1. Inadvertent application of power to EED's. 

2. Stray voltages on ordnance power lines. 

3. Inability to return safety inhibits that may have been removed during 
deployment operations to a safe configuration. 

4. Extreme temperatures at contingency landing sites causing over pressur- 
ization of propellant tanks, lines, or sealed containers or freezing of 
propellant. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I | | 

PHASE II 1 | 

PHASE III 1 , I 
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PAYLOAD HAZARD REPORT 

| NO. FLIGHT: 

| GROUND: 9 

1 

PAYLOAD: Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: | HAZARD GROUP: Corrosion 

Electrical j Contamination 

L 

IDATE: 

| October 1986 
1 

HAZARD TITLE: NiCd Batteries Hazards 

APPLICABLE SAFETY REQUIREMENT: 

1 HAZARD CATEGORY: 

KHB 1700. 7A - 4.3.2, 4.3.3 

1 XI CATASTROPHIC 


1 1 CRITICAL 

DESCRIPTION OF HAZARD: 


Rupture of the NiCd battery cells, releasing debris and/or electrolyte causing 
fire contamination and/or personnel injury.. 


HAZARD CAUSES: 


1. Structural failure of the NiCd cells. 

2. Overpressurization caused by internal or external short, cell reversal, 
overcharging, temperature extremes, or battery plate insulator failure. 


HAZARD CONTROLS: 

) 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 1 PAYLOAD ORGANIZATION ) STS 

PHASE I I | 

PHASE II | | 

PHASE III I I 
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PAYLOAD HAZARD REPORT 

I NO. FLIGHT: 

| GROUND: 10 

1 

PAYLOAD: Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: I HAZARD GROUP: Injury 

Propulsion 1 Contamination, Fire 

l 

(DATE: 

j October 1986 

J 

HAZARD TITLE: 

Inadvertent Firinq of Thrusters or Leakage of Thrusters 

APPLICABLE SAFETY REQUIREMENT: 

KHB 1700. 7A - 4.1.3 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 
1 ICRITICAL 

DESCRIPTION OF HAZARD: 


1. Inadvertent firing of thrusters could result in personnel 
equipment damage, or fire. 

2. Leakage of propellant through thrusters. 

injury. 


HAZARD CAUSES: 


1. Failures in RCS system or inadvertent commands that allows flow of 
propellant to the thrusters. 

2. Failure of seats in valves. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL I PAYLOAD ORGANIZATION I STS 

PHASE I 1 1 

PHASE II 1 1 

PHASE III I 1 
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PAYLOAD HAZARD REPORT 

I NO. FLIGHT: 

| GROUND: 11 

1 

PAYLOAD: 

Mars Observer 

| PHASE: 0 

1 

SUBSYSTEM: 

| HAZARD GROUP: Injury 

Mechanical j Contamination 

1 

(DATE: 

j October 1986 
J 

HAZARD TITLE: Rotating Equipment 

APPLICABLE 

SAFETY REQUIREMENT: 

KHB 1700. 7A - 4.3.6 

1 HAZARD CATEGORY: 
1 XI CATASTROPHIC 



1 1 CRITICAL 


DESCRIPTION OF HAZARD: 


Debris from rotating equipment (RWAs) failure could damage Orbiter, or cause 
injury to personnel. 


HAZARD CAUSES: 

1. Failure of rotating equipment (rotating wheel assemblies) during 
testing releasing debris. 


HAZARD CONTROLS: 


SAFETY VERIFICATION METHODS: 


STATUS OF VERIFICATION: 


APPROVAL 

! PAYLOAD ORGANIZATION S 

STS 

PHASE I 1 1 

PHASE II 1 1 

PHASE III 

1 1 
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